EncryptCodecencryptcodec
Simulations/HTTP Request Smuggling

HTTP Request Smuggling

Advanced

HTTP request smuggling exploits disagreements between a proxy and backend server about where one request ends and another begins. Craft a CL/TE desync attack, then configure defenses to prevent it.

Progress:
1
CL/TE Desync
2
Apply Defenses

Request Builder

Challenges

1
CL/TE Desync
Craft a request with conflicting Content-Length and Transfer-Encoding headers to smuggle a second request.
▼ hints
2
Apply Defenses
Enable the correct defenses to prevent request smuggling.
▼ hints
How to fix request smuggling
Normalize parsing, use HTTP/2, and disable keep-alive
▼

Frequently Asked Questions