2

I am trying to understand more about HTTP Request Smuggling and I have been reading this article (https://portswigger.net/web-security/request-smuggling). Content-Length represents the length of the entity-body in bytes (https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Length) but where does the counting start?

Portswigger example (CL.TE)

POST / HTTP/1.1
Host: vulnerable-website.com
Content-Length: 13
Transfer-Encoding: chunked

0

SMUGGLED

How was 13 derived? If I count the newlines before 0 and between 0 and "SMUGGLED", the total is 12? Do I count the newline after "Transfer-Encoding: chunked" as well?

Portswigger example (TE.CL)

POST / HTTP/1.1
Host: vulnerable-website.com
Content-Length: 3
Transfer-Encoding: chunked

8
SMUGGLED
0

Similarly, where do I start the counting?

Any help is appreciated.

2
  • This is not actually a security question but a question on how HTTP works. There is an actual standard for this where concepts like a HTTP header and body are defined - the length represents the length of the body. In short: the header ends with an empty line, the counting of content-length starts after this. – Steffen Ullrich Apr 27 '20 at 10:14
  • @EsaJokinen: The point of HTTP request smuggling is exactly to misuse interpretation differences in such edge cases, i.e. some HTTP stacks will look at the transfer-encoding (correct but only with HTTP/1.1) and others at the content-length (correct when version is specified as HTTP/1.0). Thus, it makes no sense to argue that based on the standard this should not be done. Attackers are free to do this and it is the task of the analyzing HTTP stack to not fall for it. – Steffen Ullrich Apr 27 '20 at 12:00
5

Content-Length represents the length of the entity-body in bytes but where does the counting start? How was 13 derived?

0 is the first character counted in your first example, but newlines in HTTP are usually CRLF (\r\n) which is two characters. Accordingly:

0\r\n            3 characters
\r\n            +2 characters
SMUGGLED        +8 characters equals 13 characters (no trailing CRLF)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.