Lab: Exploiting HTTP request smuggling to reveal front-end request rewriting

Summary: This PortSwigger lab sets up a front-end and back-end server where the front-end does not support chunked encoding, and an admin panel at /admin is reachable only from IP address 127.0.0.1. The front-end adds an HTTP header carrying the client's IP address, similar to X-Forwarded-For but under a different name, and the task is to smuggle a request that reveals that header, then smuggle a second request carrying it to reach the admin panel and delete the user carlos.
Why it matters: The access control protecting the admin panel rests entirely on an IP header the front-end appends, so anyone who can smuggle a request past the front-end can supply that header themselves and act as 127.0.0.1.

Read the original at PortSwigger Research ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026