Lab: HTTP request smuggling, confirming a CL.TE vulnerability via differential responses
Summary: This PortSwigger lab sets up a front-end and back-end server pair where the front-end does not support chunked encoding, and asks the solver to smuggle a request to the back-end so that a later request for the web root returns a 404. The lab supports HTTP/2, but the intended solution relies on techniques only possible in HTTP/1, and the instructions have the user send the same request twice in Burp Repeater, with the second receiving the 404.
What you should know: The exercise turns on a disagreement between two servers over where a request ends - the front-end ignoring chunked encoding while the back-end honors it - which is the same parsing gap that lets an attacker prepend a hidden request to the next legitimate user's traffic.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026