0

I'm trying to use chunked protocol and multipart protocol in a POST request, like this

All new-line symbols are \r\n, e.g

POST http://127.0.0.1/print.php?a=1&b=2 HTTP/1.1
accept-language: *
transfer-encoding: chunked
accept: */*
user-agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
host: 127.0.0.1
content-type: multipart/form-data; boundary=test123;

4B
--test123
Content-Disposition: form-data; name="xxx"

123
--test123--

0

But, when I post this request to a PHP server it returns 400 error, which means this is an invalid request.

Any ideas? I'm simply testing a WAF bypass method

1

While transfer-encoding chunked is defined for both response and request in the HTTP/1.1 standard (but not in HTTP/1.0) it is typically only used for responses. It is not universally supported for requests.

Apart from that your first line should only include the path and not the full URL. While HTTP/1.1 (contrary to HTTP/1.0) explicitly allowed the full URL in this place lots of servers don't accept this.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.