Lab: Exploiting HTTP request smuggling to capture other users' requests
Summary: This PortSwigger lab sets up a front-end and back-end server where the front-end does not support chunked encoding, and asks the solver to smuggle a request to the back-end that stores the next user's request in the application. The solver then retrieves that stored request and uses the victim's cookies to access their account, with guidance to raise the comment-post request's Content-Length to 400 and increase it further until the whole Cookie header is captured.
What you should know: The attack turns a single crafted request into theft of the next user's session cookies, so one smuggling flaw in a front-end/back-end mismatch hands over live authenticated accounts rather than just error pages.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026