Request smuggling - do more than running tools! HTTP Request smuggling bug bounty case study

Request smuggling is an amazing bug class! But I barely ever did more than running Request Smuggler. So I've analysed tens of reports and in this video, I'll break down the most common root causes and I'll give you some ideas for future research.

Reports mentioned in the video:

Reports mentioned in the video:
Whitespace characters in CL/TE headers
Incorrect prioritization of CL/TE
Multiple TE/CL headers
Ignoring the TE/CL headers
Not closing the connection
HTTP/2 downgrade forwarding CL/TE
Only \n or \r as a newline
Not a literal "chunked" TE
CRLF injection
Trailer parsing
H2C upgrade
Converting \r to -
Chunk extensions

Timestamps:

00:00 Intro
00:34 Whitespace characters in CL/TE headers
3:45 Incorrect prioritization of CL/TE headers
5:26 Multiple TE/CL headers
7:22 Ignoring the TE/CL headers
10:05 Not closing the connection
11:40 HTTP/2 downgrade forwarding CL/TE
14:02 Only \n or \r as a newline
15:35 Not a literal "chunked" TE
16:39 CRLF injection
17:49 Trailer parsing
19:26 H2C upgrade
20:42 Converting \r to -
22:20 Chunk extensions

[BugBountyReportsExplained]

Thank you for watching this video. If you've learnt something new, leave a like to show me that you appreciate it!

[musawerkhan]

Why do we have to use white space character please clarify this is possible

[dayxyz]

In addition to Burp Plugin HTTP Request Smuggler, what other methods can find this vulnerability?🤒

[crlfff]

I’ve watched so many videos, done courses on http request smuggling and still don’t understand. I’m thinking about making a http server in C to exploit it myself to understand it better

[HerlockShomes]

Hi thanks for the video, can I get the notion link of the reports?

[kunshtanwar]

Hey dude, great video as always.
I had a question for so long after completing all the labs related to http request smuggling from portswigger is that I am able to identify the HRS vulnerabilities using the detection method, and even the Smuggler tool but never able to showcase a full-proof POC because I have seen people use Turbo intruder for that like here 6:26, and I couldn't find a place to learn that so I request you if you can make a video on how to actually make a POC or show the IMPACT as we say, because I have so many places I couldn't show the actual poc it was annoying.

[fengzhi-pf]

您好，我有一些关于 HTTP 请求走私的问题。我如何在 Discord 上联系你们？

[airsky]

Hello, I am from China. I like the video content of your channel very much. I want more people to learn these vulnerabilities. Can I translate your video and repost it to the Chinese bilibili video website? I will mark your YouTube address on the video page, thank you

[alvarobalada]

Next Video: $$.$$$ bounty using request smuggling