Lab: Exploiting HTTP request smuggling to deliver reflected XSS
Summary: This PortSwigger lab sets up a front-end and back-end server pair where the front-end does not support chunked encoding, and the application reflects input from the User-Agent header, making it vulnerable to reflected XSS. The exercise is to smuggle a request to the back-end so the next user's request receives a response containing an XSS payload that executes alert(1), and the lab notes the target user browses only intermittently, so the attack may need repeating.
Bottom line: The exploit chains two flaws that look minor alone - a front-end that rejects chunked encoding and a reflected User-Agent header - into an attack that lands on a different user than the one sending it, meaning the victim never has to click a crafted link.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026