I'm trying to use chunked protocol and multipart protocol in a POST request, like this

All new-line symbols are \r\n, e.g

accept-language: *
transfer-encoding: chunked
accept: */*
user-agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
content-type: multipart/form-data; boundary=test123;

Content-Disposition: form-data; name="xxx"



But, when I post this request to a PHP server it returns 400 error, which means this is an invalid request.

Any ideas? I'm simply testing a WAF bypass method

1 Answer 1


While transfer-encoding chunked is defined for both response and request in the HTTP/1.1 standard (but not in HTTP/1.0) it is typically only used for responses. It is not universally supported for requests.

Apart from that your first line should only include the path and not the full URL. While HTTP/1.1 (contrary to HTTP/1.0) explicitly allowed the full URL in this place lots of servers don't accept this.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .