I'm testing some API endpoints aaand with some arbitrary crazy tests, like:
GET /products/items HTTP/1.1
Host: api.companysite.com
Content-Type: application/xml
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/535.12 (KHTML, like Gecko) Maxthon/3.0 Chrome/26.0.1410.43 Safari/535.12
Connection: keep-alive
Content-Length: 47
GET /robots.txt HTTP/1.1
Host: app.companysite.com
Where that GET /robots HTTP/1.1 part is in body of GET /products/items request, I received the craziest response:
HTTP/1.1 400 Bad Request
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0
Content-Type: application/json; charset=UTF-8
Expires: 0
Last-Modified: 2019-09-19 07:19:08.998002474 +0000 UTC
Pragma: no-cache
Strict-Transport-Security: max-age=31536000;
Vary: Origin
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
Content-Length: 71
Date: Thu, 19 Sep 2019 07:19:09 GMT
Connection: keep-alive
{"status":"ERROR","message":"No Authorization header","code":"AUTH01"}
HTTP/1.1 200 OK
Content-Type: text/plain
Last-Modified: Thu, 12 Sep 2019 09:37:21 GMT
ETag: "5d7a11d1-36"
X-Frame-Options: DENY
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
CF-Visitor: {scheme:https}
Cache-Control: max-age=1066261
Expires: Tue, 01 Oct 2019 15:30:10 GMT
Date: Thu, 19 Sep 2019 07:19:09 GMT
Content-Length: 54
Connection: keep-alive
User-agent: *
Sitemap: https://app.companysite.com/sitemap.xml
I know this gives a 400 response code because of the body in the GET request, but what about that second part of this response? Why Am I able to send two different requests using one GET request? It is not the request smuggling attack, there are no CL.TE, TE.CE, TE.TE headers and obviously there are no POST requests. What is going on over there, what do you think?