Lab: HTTP request smuggling, basic TE.CL vulnerability
Summary: PortSwigger's lab sets up a front-end and back-end server where the back-end does not support chunked encoding and the front-end rejects any request not using GET or POST. The goal is to smuggle a request so the back-end processes the next request as method GPOST, which the lab confirms when the second response reads "Unrecognized method GPOST."
What's compelling: The exploit works because the front-end and back-end disagree on where a request ends, so a request the front-end approves can carry a second one the back-end acts on - a gap that exists whenever two servers parse the same bytes differently.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026