Questions tagged [request-smuggling]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0
votes
1answer
195 views

Nessus Plugin “HTTP Smuggling Detection” failing due to support for http/1.1 - how to overcome?

A new Nessus plugin (140735 - HTTP Smuggling Detection) was very recently incorporated into Tenable's PCI template and is now beeing flagged as a "medium" vulnerability and causing scans to ...
0
votes
1answer
89 views

HTTP Request Smuggling Basics

I am currently trying to learn HTTP Request Smuggling vulnerability to further enhance my pen testing skills. I have watched a couple of videos on Youtube and read articles online regarding it but ...
2
votes
0answers
31 views

Force Apache Server/Tomcat to ignore Transfer-Encoding

I am trying to reproduce HTTP request smuggling using an Apache HTTP Server as a reverse proxy (using mod_proxy) and a Tomcat Server in the back-end. Is it possible to force either Apache Server or ...
0
votes
0answers
54 views

Is this an example of HTTP request smuggling?

I believe I found an HTTP smuggling vulnerability but I'm not sure. When I send a request like this POST /test HTTP/1.1 Host: www.example.com Accept-Encoding: gzip, deflate Accept: */* Accept-...
2
votes
1answer
48 views

What does “connection” mean in context of request smuggling

I recently read about request smuggling. This is a very interesting attack that I didn't know about. A vulnerability to this was recently discovered at Slack, disclosed responsibly and a bounty was ...