6

I'm testing some API endpoints aaand with some arbitrary crazy tests, like:

GET /products/items HTTP/1.1
Host: api.companysite.com
Content-Type: application/xml
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/535.12 (KHTML, like Gecko) Maxthon/3.0 Chrome/26.0.1410.43 Safari/535.12
Connection: keep-alive
Content-Length: 47

GET /robots.txt HTTP/1.1
Host: app.companysite.com

Where that GET /robots HTTP/1.1 part is in body of GET /products/items request, I received the craziest response:

HTTP/1.1 400 Bad Request
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0
Content-Type: application/json; charset=UTF-8
Expires: 0
Last-Modified: 2019-09-19 07:19:08.998002474 +0000 UTC
Pragma: no-cache
Strict-Transport-Security: max-age=31536000;
Vary: Origin
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
Content-Length: 71
Date: Thu, 19 Sep 2019 07:19:09 GMT
Connection: keep-alive

{"status":"ERROR","message":"No Authorization header","code":"AUTH01"}
HTTP/1.1 200 OK
Content-Type: text/plain
Last-Modified: Thu, 12 Sep 2019 09:37:21 GMT
ETag: "5d7a11d1-36"
X-Frame-Options: DENY
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
CF-Visitor: {scheme:https}
Cache-Control: max-age=1066261
Expires: Tue, 01 Oct 2019 15:30:10 GMT
Date: Thu, 19 Sep 2019 07:19:09 GMT
Content-Length: 54
Connection: keep-alive

User-agent: *
Sitemap: https://app.companysite.com/sitemap.xml

I know this gives a 400 response code because of the body in the GET request, but what about that second part of this response? Why Am I able to send two different requests using one GET request? It is not the request smuggling attack, there are no CL.TE, TE.CE, TE.TE headers and obviously there are no POST requests. What is going on over there, what do you think?

  • 1
    when you see multiple HTTP request on the same TCP segment is in general what is called 'HTTP pipelining'. – camp0 Sep 19 '19 at 7:58
  • @camp0 I think that might be the answer, why not post it as an answer? – Luc Sep 19 '19 at 8:00
  • Added as answer sorry Im a bit sleepy :) – camp0 Sep 19 '19 at 8:02
5

When you see multiple HTTP request on the same TCP segment, in general this is called 'HTTP pipelining'

By using pipelining, you can put multiple methods on one request from the client side: https://en.wikipedia.org/wiki/HTTP_pipelining

  • 1
    Can you please expand your answer a bit? What is HTTP Pipelining? – MechMK1 Sep 19 '19 at 8:05
  • All right, it make sense right now. This is how the turbo intruder was make, obviously. One more thing learned today - thanks! – the_me Sep 19 '19 at 8:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.