6

I'm testing some API endpoints aaand with some arbitrary crazy tests, like:

GET /products/items HTTP/1.1
Host: api.companysite.com
Content-Type: application/xml
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/535.12 (KHTML, like Gecko) Maxthon/3.0 Chrome/26.0.1410.43 Safari/535.12
Connection: keep-alive
Content-Length: 47

GET /robots.txt HTTP/1.1
Host: app.companysite.com

Where that GET /robots HTTP/1.1 part is in body of GET /products/items request, I received the craziest response:

HTTP/1.1 400 Bad Request
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0
Content-Type: application/json; charset=UTF-8
Expires: 0
Last-Modified: 2019-09-19 07:19:08.998002474 +0000 UTC
Pragma: no-cache
Strict-Transport-Security: max-age=31536000;
Vary: Origin
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
Content-Length: 71
Date: Thu, 19 Sep 2019 07:19:09 GMT
Connection: keep-alive

{"status":"ERROR","message":"No Authorization header","code":"AUTH01"}
HTTP/1.1 200 OK
Content-Type: text/plain
Last-Modified: Thu, 12 Sep 2019 09:37:21 GMT
ETag: "5d7a11d1-36"
X-Frame-Options: DENY
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
CF-Visitor: {scheme:https}
Cache-Control: max-age=1066261
Expires: Tue, 01 Oct 2019 15:30:10 GMT
Date: Thu, 19 Sep 2019 07:19:09 GMT
Content-Length: 54
Connection: keep-alive

User-agent: *
Sitemap: https://app.companysite.com/sitemap.xml

I know this gives a 400 response code because of the body in the GET request, but what about that second part of this response? Why Am I able to send two different requests using one GET request? It is not the request smuggling attack, there are no CL.TE, TE.CE, TE.TE headers and obviously there are no POST requests. What is going on over there, what do you think?

  • 1
    when you see multiple HTTP request on the same TCP segment is in general what is called 'HTTP pipelining'. – camp0 Sep 19 '19 at 7:58
  • @camp0 I think that might be the answer, why not post it as an answer? – Luc Sep 19 '19 at 8:00
  • Added as answer sorry Im a bit sleepy :) – camp0 Sep 19 '19 at 8:02
5

When you see multiple HTTP request on the same TCP segment, in general this is called 'HTTP pipelining'

By using pipelining, you can put multiple methods on one request from the client side: https://en.wikipedia.org/wiki/HTTP_pipelining

| improve this answer | |
  • 1
    Can you please expand your answer a bit? What is HTTP Pipelining? – MechMK1 Sep 19 '19 at 8:05
  • All right, it make sense right now. This is how the turbo intruder was make, obviously. One more thing learned today - thanks! – the_me Sep 19 '19 at 8:27
0

As @camp0 said, it's http pipelining. Now days used by load balancers, cns, firewalls, etc.. to communicate to back-end systems. For the sake of resources, time and cost, one tcp connection is used to send multiple http requests.

A request life cycle can be rich. And in most modern web apps it is. When you send a request it may go trough server which serves as the analytic system, then trough a firewall, then the actual application server. I'm just making this specific route up, but I hope you get the point. Those servers forward requests trough a small pool of connections, it's cheaper and faster that way.

Yes, old vulnerabilities are becoming trendy because of a change in how we create applications. But that is normal. And always will be.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.