HTTP request smuggling, basic TE.CL vulnerability - Lab#15

In this video, I walk through the Basic TE.CL HTTP Request Smuggling vulnerability, a fundamental desynchronization attack that occurs when front-end and back-end servers interpret HTTP requests differently. In this lab, the back-end server does NOT support chunked encoding, while the front-end processes requests using Transfer-Encoding. This mismatch creates a TE.CL vulnerability, allowing us to smuggle a hidden request into the back-end connection. Even though the front-end server only allows GET and POST methods, we can exploit this parsing inconsistency to manipulate how the back-end interprets the next request—making it appear as the invalid method GPOST, which confirms successful request smuggling. 🎯 What you’ll learn in this video: ✔️ What TE.CL request smuggling is and how it works ✔️ Differences between Transfer-Encoding and Content-Length handling ✔️ How to exploit back-end servers that don’t support chunked encoding ✔️ Crafting a smuggled request to trigger desynchronization ✔️ Verifying the attack using the GPOST method This lab is perfect for beginners getting started with HTTP request smuggling and understanding how subtle parsing issues can lead to serious security vulnerabilities. ⚠️ Educational purposes only. Always test on authorized systems. 👍 Don’t forget to like, comment, and subscribe for more PortSwigger Web Security Academy walkthroughs and advanced web security content! 🔖 Hashtags: #HTTPRequestSmuggling #TECL #WebSecurity #BugBounty #EthicalHacking #PortSwigger #BurpSuite #WebAppSec #CyberSecurity #Pentesting #OWASP