HTTP Request Smuggling is the attack used to steal cookies and other traffic-based credentials over a vulnerable configured server.
Attack vectors of HTTP Request Smuggling: (Use the Burp Suite for the following)
Parameters in the request. 2 parameters, Content-Length and Transfer-Encoding matter as the surface of this attack. If they both are present in the same request, it's likely that the request is dealing with the front-end and back-end server for parsing.
Also, the Transfer-Encoding parameter should be in a chunked state, this means that more than 1 servers are present on the other side. If another user is requesting the server at the same time, the request will randomly choose either front or back end server for processing on either of the parameters.
HTTP Request Smuggling is rated 7~8.9 in the criticality rate and can be considered a severe vulnerability. It should be included in a POC and is legal, unless the company does not provide the consent to you for testing their systems. POCs should either be provided on platforms like HackerOne or BugCrowd, or should be mailed to the security team with a private YouTube video describing it.
HTTP Request Smuggling can be chained with other tier-1 CDN-related attacks like cookie hijacking or sometimes a SSRF in case of a misconfigured server, token entropy or vulnerable headers.
For the CL;TE headers being, when you use an additional body in the request, the front-end and back-end server parse the body accordingly to the headers passed.
For example, if the following request is passed:
The front-end server is accepting the Content-Length header, thus it will parse out the EXPLOITS string and send the request to the back-end server. The back-end server will parse out 0 first and since it indicates 0 bytes, it will not process the request body beneath it as the parsing will stop. So, the EXPLOITS string will be unprocessed till a new request arrives and will process it including the new request and will give out the response to the new request.
The headers can be obfuscated in a number of ways, like
Any obfuscation you can play with until you get the response in the repeater tab of Burp Suite resulting either a time delay or unexpected content. You can also send 2 quick succession queries to the server for confirming the vulnerability.
Hope this helps!