Trying to do a chunked multipart post request, nginx and php both returns 400 error

Question

I'm trying to use chunked protocol and multipart protocol in a POST request, like this

All new-line symbols are \r\n, e.g

POST http://127.0.0.1/print.php?a=1&b=2 HTTP/1.1
accept-language: *
transfer-encoding: chunked
accept: */*
user-agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
host: 127.0.0.1
content-type: multipart/form-data; boundary=test123;

4B
--test123
Content-Disposition: form-data; name="xxx"

123
--test123--

0

But, when I post this request to a PHP server it returns 400 error, which means this is an invalid request.

Any ideas? I'm simply testing a WAF bypass method

Answer 1

While transfer-encoding chunked is defined for both response and request in the HTTP/1.1 standard (but not in HTTP/1.0) it is typically only used for responses. It is not universally supported for requests.

Apart from that your first line should only include the path and not the full URL. While HTTP/1.1 (contrary to HTTP/1.0) explicitly allowed the full URL in this place lots of servers don't accept this.