Request Smuggling Attack - ties2/web-pentest GitHub Wiki

Request Smuggling Attack is a web application security vulnerability that involves manipulating the way a web server and a proxy server interpret the headers of an HTTP request. This type of attack can cause the application to behave unexpectedly, such as bypassing security controls, executing unauthorized actions, and leaking sensitive information. In this article, we will explore the different types of Request Smuggling Attacks with examples.

Overview of Request Smuggling Attack

In a Request Smuggling Attack, an attacker tricks a web server or proxy server into parsing an HTTP request in a way that differs from the intended parsing performed by other components in the request path. The attacker can achieve this by manipulating the order or content of the HTTP request headers. This can cause the request to be interpreted differently by different components in the request path, leading to unexpected behavior.

The Request Smuggling Attack relies on the fact that the HTTP protocol allows for multiple requests to be transmitted in a single HTTP request message. This technique is called "HTTP request smuggling" because the attacker can smuggle additional requests within a single HTTP request.

Types of Request Smuggling Attacks

Content-Length Smuggling Attack A Content-Length Smuggling Attack involves manipulating the Content-Length header of an HTTP request. This header specifies the length of the request body, and it is used by the web server to determine when the entire request has been received. In a Content-Length Smuggling Attack, an attacker can manipulate the value of this header to make the web server interpret the request body in a way that differs from other components in the request path.

Example:

Consider the following HTTP request:

POST /login HTTP/1.1 Host: example.com Content-Type: application/x-www-form-urlencoded Content-Length: 10

username=test&password=1234

An attacker can manipulate the Content-Length header as follows:

POST /login HTTP/1.1 Host: example.com Content-Type: application/x-www-form-urlencoded Content-Length: 20

username=test &password=1234 Content-Length: 10

username=test&password=1234

In this example, the attacker has added an additional Content-Length header with a value of 10 after the request body. This can cause the web server to interpret the request in two different ways, depending on how it handles multiple Content-Length headers.

Transfer-Encoding Smuggling Attack A Transfer-Encoding Smuggling Attack involves manipulating the Transfer-Encoding header of an HTTP request. This header specifies the encoding of the request body, and it is used by the web server to determine how to decode the request body. In a Transfer-Encoding Smuggling Attack, an attacker can manipulate the value of this header to make the web server interpret the request body in a way that differs from other components in the request path.

Example:

Consider the following HTTP request:

POST /login HTTP/1.1 Host: example.com Content-Type: application/x-www-form-urlencoded Transfer-Encoding: chunked

4 user 5 name= 4 test

An attacker can manipulate the Transfer-Encoding header as follows:

POST /login HTTP/1.1 Host: example.com Content-Type: application/x-www-form-urlencoded Transfer-Encoding: chunked

4 user 5 name= 0

POST /admin HTTP/1.1 Host: example.com Content-Type: application/x-www-form-urlencoded Content-Length: 19

username=admin&password=1234

Overview of Request Smuggling Attack

Types of Request Smuggling Attacks

Example:

Consider the following HTTP request:

makefile Copy code POST /login HTTP/1.1 Host: example.com Content-Type: application/x-www-form-urlencoded Content-Length: 10

username=test&password=1234 An attacker can manipulate the Content-Length header as follows:

makefile Copy code POST /login HTTP/1.1 Host: example.com Content-Type: application/x-www-form-urlencoded Content-Length: 20

username=test &password=1234 Content-Length: 10

username=test&password=1234 In this example, the attacker has added an additional Content-Length header with a value of 10 after the request body. This can cause the web server to interpret the request in two different ways, depending on how it handles multiple Content-Length headers.

Example:

Consider the following HTTP request:

makefile Copy code POST /login HTTP/1.1 Host: example.com Content-Type: application/x-www-form-urlencoded Transfer-Encoding: chunked

4 user 5 name= 4 test An attacker can manipulate the Transfer-Encoding header as follows:

makefile Copy code POST /login HTTP/1.1 Host: example.com Content-Type: application/x-www-form-urlencoded Transfer-Encoding: chunked

4 user 5 name= 0

POST /admin HTTP/1.1 Host: example.com Content-Type: application/x-www-form-urlencoded Content-Length: 19

username=admin&password=1234 In this example, the attacker has added an additional HTTP request after the original request by inserting a chunked-encoded HTTP request within the original request body. This can cause the proxy server to interpret the request in two different ways, depending on how it handles multiple Transfer-Encoding headers.

3.HTTP Verb Tampering Attack An HTTP Verb Tampering Attack involves manipulating the HTTP verb used in an HTTP request. This type of attack can occur when a web server or application server is configured to allow multiple HTTP verbs (e.g., GET, POST, PUT, DELETE) for a particular resource. An attacker can send an HTTP request with an unintended HTTP verb, causing the server to perform unexpected actions.

Example:

Consider a web application that has an endpoint /user that allows GET requests to retrieve user information and POST requests to update user information. An attacker can send a POST request with an HTTP verb of GET to retrieve sensitive user information.

GET /user HTTP/1.1 Host: example.com Content-Type: application/json Content-Length: 34 Connection: close

{"username":"admin","password":"1234"}

In this example, the attacker is able to bypass the security controls of the application by sending a GET request with a JSON payload containing sensitive user information.

Prevent Request smuggling Attack:

Use HTTP/2 or HTTPS to prevent request smuggling attacks

cheat sheet for Request Smuggling Attacks:

Content-Length Smuggling Attack: Manipulate the value of the Content-Length header to cause different components in the request path to interpret the request body differently. Add additional Content-Length headers to the request. Transfer-Encoding Smuggling Attack: Manipulate the value of the Transfer-Encoding header to cause different components in the request path to interpret the request body differently. Insert chunked-encoded HTTP requests within the original request body. HTTP Verb Tampering Attack: Manipulate the HTTP verb used in an HTTP request to cause the server to perform unexpected actions. Send a request with an unintended HTTP verb to bypass security controls. To prevent Request Smuggling Attacks, consider implementing the following security controls:

Normalize and validate HTTP headers to prevent ambiguity and unexpected behavior. Use a secure configuration for proxy servers and other network components. Implement secure coding practices and input validation to prevent unauthorized actions and information disclosure.