When you can trick the front and the back of your application causing it to behave unexpectedly.

当您可以欺骗应用程序的正面和背面时，导致其行为异常。

Vulnerability, that could allow malicious actors to leverage specific features of the HTTP/1.1 protocol in order to bypass security protections and obtain sensitive information from requests other than their own.

以便在HTTP / 1.1协议第V ulnerability，可能允许恶意行动者利用特定功能，以旁路安全保护，将获得从自己以外的请求的敏感信息。

The HTTP request smuggling vulnerability was first discovered by Watchfire in their 2005 whitepaper entitled “HTTP Request Smuggling”. Then the work was later expanded by researcher Regis Leroy which was further discussed by James Kettle from Portswigger security during BlackHat USA 2019.

HTTP请求走私漏洞是Watchfire在其2005年的白皮书《 HTTP请求走私 》中首次发现的。 然后研究人员Regis Leroy扩大了工作，在2019年BlackHat USA大会上来自Portswigger安全部门的James Kettle进一步讨论了该工作。

一些重要术语 (Some Important Terms)

Before diving into what HTTP Request Smuggling is and how it operates, there are some important terms we need to know. I have listed some here.

在深入研究什么是HTTP请求走私及其运行方式之前，我们需要了解一些重要的术语。 我在这里列出了一些。

• Keep-Alive Header: By default, HTTP connections closes after each request. That means when someone visits your site, the browser needs to create new connections to request each of the files that make makes up the web pages. The HTTP keep-alive header maintains a connection between a client and your server, reducing the time needed to load the files.

  保持活动标头： 默认情况下，HTTP连接在每个请求后关闭。 这意味着，当有人访问您的站点时，浏览器需要创建新的连接来请求构成网页的每个文件。 HTTP保持活头 保持客户端和服务器之间的连接，减少了加载文件所需的时间。

• Pipelining: This feature allows a web server to process requests asynchronously rather than processing each request individually. It sends a request without waiting for a previous response to arrive.

  流水线： 此功能允许Web服务器异步处理请求，而不是单独处理每个请求。 它发送请求而无需等待先前的响应到达。

• Content-Length and Transfer-Encoding Header: These headers are used for message framing, informing a server where a message ends and another begins. The content-length header indicates the size of the entity-body of the request which is commonly seen in the HTTP Post request. Transfer-Encoding header specifies the form of encoding used to safely transfer the payload body to the user.

  内容长度标头和传输编码标头：这些标头用于消息框架，通知服务器消息的结束位置和消息的开始位置。 content-length标头指示在HTTP Post请求中常见的请求实体的大小。 Transfer-Encoding标头指定用于将有效载荷主体安全地传输给用户的编码形式。

什么是请求走私？ (What is Request Smuggling?)

Most of the modern web stack consists of multiple web servers along with load balancers.

大多数现代Web堆栈都由多个Web服务器以及负载平衡器组成。

HTTP Request Smuggling is a type of attack where malicious actor abuses how two HTTP devices send requests between each other by modifying a request to include two requests within the body of a singular request. This informs the server where the request ends by modifying the Content-Length and Transfer-Encoding header.

HTTP请求走私是一种攻击类型，恶意行为者通过修改请求以将两个请求包含在单个请求的主体内来滥用两个HTTP设备在彼此之间发送请求的方式。 这通过修改Content-Length和Transfer-Encoding标头来通知服务器请求在何处结束。

它如何发生？ (How does it occur?)

Whenever the front end server sends an HTTP request to the backend server to make it more efficient, it sends several requests over the same back-end network connection. The HTTP requests are sent one after another, and the receiving server parses the HTTP request headers to determine where one request ends and the next one begins.

每当前端服务器向后端服务器发送HTTP请求以提高其效率时，它都会通过同一后端网络连接发送多个请求。 依次发送HTTP请求，接收服务器解析HTTP请求标头，以确定一个请求在哪里结束，下一个请求在哪里开始。

This is where malicious actor, causes part of the front-end request to be interpreted by the backend server as the start of the next request. Effectively, prepended to the next request, and so can interfere with the way the application processes that request. And this how the HTTP Request Smuggling attack occurs.

这是恶意行为者导致前端请求的一部分被后端服务器解释为下一个请求的开始的地方。 实际上，它优先于下一个请求，因此会干扰应用程序处理该请求的方式。 这就是HTTP请求走私攻击的发生方式。

Most of the HTTP specification provides two different ways to specify where a request ends. They are Content-Length and Transfer-Encoding header. Because of there two methods, it is possible for a single message to use both methods at once, such that they conflict with each other. However, we need to keep in mind that some servers do not support the transport-encoding header. While some do not do support the transfer-encoding header can be induced not to process it if the header is obfuscated in some way.

大多数HTTP规范提供了两种不同的方法来指定请求的结束位置。 它们是Content-Length和Transfer-Encoding标头。 由于存在两种方法，一条消息可能会同时使用这两种方法，从而使它们彼此冲突。 但是，我们需要记住，某些服务器不支持传输编码标头。 尽管有些不支持，但如果以某种方式混淆了头，则可以诱导传输编码头不对其进行处理。

一些攻击技巧 (Some Attack Techniques)

There are several different attack methods using HTTP Request Smuggling. Among them, some of them are Cross-Site Scripting (XSS). In this kind of attack, the attacker does not target the specific user but targets any users of the application.

使用HTTP请求走私有几种不同的攻击方法。 其中，其中一些是跨站点脚本(XSS)。 在这种攻击中，攻击者不是针对特定用户，而是针对应用程序的任何用户。

There are also different types of Request Smuggling, which are:

请求走私也有不同类型 ，它们是：

TE: TE- Both the frontend and the backend servers support the Transfer-Encoding header.

TE：TE-前端服务器和后端服务器均支持Transfer-Encoding标头。

CL: TE- Here, the frontend supports content-length whereas, the backend supports transfer-encoding header

CL：TE-在这里，前端支持content-length，而后端则支持transfer-encoding标头

TE: CL — The frontend supports transfer-encoding header while the backend supports content-length

TE：CL —前端支持传输编码标头，而后端支持content-length

CL: CL- Double content length attack technique

CL：CL-双重内容长度攻击技术

TE: TE — Both the back and the frontend supports transfer-encoding header.

TE：TE —后端和前端都支持传输编码标头。

In this article, I will demonstrate two of the attack techniques- CL: CL &CL: TE

在本文中，我将演示两种攻击技术-CL：CL＆CL：TE

1. CL: CL ( Double Content-Length)

   CL：CL(双重内容长度)

GET / HTTP/1.1
Content-Length: 60
Content-Length: 0
Host: example.comGET /reqexample HTTP/1.1
Host: example.com

In the above request, you can see that two content-length headers are sent to a target that has a proxy or a load balancer as a frontend. The proxy will prioritize the first one and view the smuggled request as part of the request body. However, the GET method shouldn’t have a request body but here two Content-Length headers have been provided. Now, this is processed by the backend processes the second Content-Length header ignoring the first content-length header.

在以上请求中，您可以看到将两个内容长度标头发送到具有代理或负载平衡器作为前端的目标。 代理将优先处理第一个请求，并将走私请求视为请求正文的一部分。 但是，GET方法不应具有请求正文，但此处提供了两个Content-Length标头。 现在，由后端处理第二个Content-Length头，而忽略第一个content-length头，对此进行处理。

Since the second Content-Length has the value zero, the backend will expect no request body, and the /reqexample request is treated as another pipelined request. As a result, the response of this smuggled request could be received by another user.

由于第二个Content-Length的值为零，因此后端将不希望任何请求主体，并且/ reqexample请求被视为另一个管道请求。 结果，该走私请求的响应可以被另一用户接收。

2. CL: TE ( Content-Length: Transfer-Encoding)

2. CL：TE(内容长度：传输编码)

POST /login HTTP/1.1
Host: example.com
Content-Type: application/x-www-form-urlencoded
Content-Length: 52
Transfer-Encoding: chunked13
login=xxxx&password=xxxx
0GET /404 HTTP/1.1
X-Foo: bar

When the above request gets processed by proxies, the content-length header will be prioritized rather than the transfer-encoding header. However, the backend prioritizes just the opposite which is the transfer-encoding header. And, the backend will process the request ending at character 0. As a result, the 404 GET request gets treated as a separate pipelined request.

当上述请求由代理处理时，将优先确定content-length报头，而不是传输编码报头。 但是，后端优先处理与传输编码标头相反的优先级。 并且，后端将处理以字符0结尾的请求。结果，404 GET请求被视为单独的流水线请求。

补救HTTP请求走私的一些方法 (Some ways to remediate HTTP Request Smuggling)

• Make sure that the same server software is used on both the front and back end servers so they agree on which header they will use will prevent the conflicts.
  确保前端和后端服务器上使用相同的服务器软件，以便它们就将使用的标头达成共识，以防止冲突。
• Disable reuse of backend connections. Ensure that each back-end request is sent over a separate network connection.
  禁用后端连接的重用。 确保每个后端请求都是通过单独的网络连接发送的。
• Use HTTP/2 for back-end connections, since the protocol prevents ambiguity about the boundaries between requests.
  将HTTP / 2用于后端连接，因为该协议可防止有关请求之间的边界的歧义。
• Prioritize Transfer-Encoding header over a content-length header by both backend and frontend.
  后端和前端都将Transfer-Encoding头优先于content-length头。
• Disallow requests that consist of both Content-length and Transfer encoding or double Content-Length headers.
  禁止同时包含Content-length和Transfer编码或双重Content-Length标头的请求。

Conclusion: In this article, I have explained some basic concepts and techniques of the HTTP Smuggling attack for educational purposes. You can further regarding the research conducted by James Kettle. Also, you can go through the session given by him during the BlackHat USA 2019.

Çonclusion： 在这篇文章中，我已经解释了一些基本概念和HTTP走私攻击教育目的的技术。 您可以进一步了解由 詹姆斯·凯特尔(James Kettle) 。 此外，您可以参加他在 BlackHat USA 2019 期间举行的会议 。

翻译自: https://medium.com/digital-diplomacy/tricking-the-frontend-and-the-backend-http-request-smuggling-81adc9a61181