Request Smuggling - CL.TE Scanner
Detects CL.TE HTTP request smuggling vulnerabilities.
What is Request Smuggling - CL.TE?
CL.TE (Content-Length/Transfer-Encoding) HTTP request smuggling occurs when a front-end server uses Content-Length to determine request boundaries while a back-end uses Transfer-Encoding: chunked. Attackers craft requests interpreted differently by each server, smuggling a second request hidden inside the first.
Why is This Important?
Request smuggling enables severe attacks: bypassing security controls, cache poisoning, credential hijacking, and request hijacking. It affects the infrastructure layer, potentially impacting all users. A single vulnerability can compromise the entire application, regardless of how secure the application code itself is.
How It Works
1. Attack Surface Mapping
Identifies complex attack vectors including race conditions, desync points, and logic flaws in your application.
2. Advanced Exploitation
Executes sophisticated attack techniques that bypass traditional security controls and detection mechanisms.
3. Impact Assessment
Demonstrates real-world impact with detailed exploitation chains and business risk analysis.
Key Capabilities
Expert-level security testing for sophisticated vulnerabilities that evade traditional scanning tools.
- Race condition and timing attack detection
- Request smuggling and desync analysis
- Business logic flaw identification
- Chained exploit development
- Protocol-level vulnerability testing
Frequently Asked Questions
How does CL.TE smuggling work technically?
Attacker sends a request with both headers. Front-end uses Content-Length to forward X bytes. Back-end uses Transfer-Encoding, reads until chunk end (0 ). Data after chunk end becomes the start of the 'next' request, which gets prefixed to a real user's subsequent request.
What can attackers achieve with CL.TE smuggling?
Attack possibilities: bypass front-end security/WAF, hijack other users' requests, steal credentials from prefixed requests, poison web caches with malicious responses, perform reflected XSS without user interaction, and access restricted endpoints directly.
How do I detect CL.TE vulnerabilities?
Detection methods: send timing-based probes (request that causes timeout if interpreted one way), use tools like smuggler.py or Burp's HTTP Request Smuggler, test with ambiguous CL/TE combinations, and monitor for unexplained request anomalies in logs.
How do I prevent CL.TE request smuggling?
Prevention: use HTTP/2 end-to-end (when possible), configure front-end to normalize requests, reject ambiguous requests (both CL and TE), use the same HTTP parsing library throughout, disable back-end support for chunked encoding if not needed, and implement strict request validation.
Related Scanners
Ready to secure your application?
Start testing for request smuggling - cl.te vulnerabilities today.
Get Started Free