what's going on everyone in this video i want to talk about http request
smuggling this can be quite a complex thing to understand took me a while to
understand it to begin with but it's actually quite simple once you
understand it properly so http request smuggling essentially is vulnerable when
the front end and back end web server can't agree on what's being sent by the
user so the front-end web server might be sent a http request
and the back-end web server might split
those requests because the content length header and the transfer encoding
header are not equal in both requests
and you'll see what i mean by that in this in this demo so i'm using the web
security academy demo here with burp suite and
what the aim of this lab is is to gain access to another user's
session cookie so another user using this web application session cookie
so to do that we need to find somewhere we can write to the web application to
post that data to and you'll see why you need to do that in a minute this is a
blog so typically you have a leave comment section
so if i just go ahead and leave a comment here
and i want to intercept this and send it to repeater
so we can play that in a minute firstly you'll see that i've made the
comment if we go to repeater this is the post request to make that
comment so
burp and the web application have some headers here that we don't actually need
so we'll just go ahead and remove that uh we'll remove the accept and user
agent and that is a good base so
to do the http request smuggling attack we need to kind of embed this post
request within another post request so we can go ahead and just
copy that line send the post request just to the home
page it doesn't really matter where it's being sent to because this is the the
part we're interested in we want to take out the host header here
and put that in the first request we want to
have the content type but the same and we want to use chunked encoding which
i've got in another file alt copy and paste and
when you use chunked encoding that essentially means the http web server is
going to look for multiple http requests coming in so to
kind of determine what h request is coming next or it needs another one you
can use the zero character to say that's the end of the
first chunk http request so then the next request coming in will be this
so as i said you need to find somewhere that will be writable and this comment
section was going to be that so this comment parameter here is going to be
that writable section for us so if we go ahead and just
copy that and paste it at the end of the file here and just i'm just going to put
some x's here so once it's here we'll know which is the right request
we then need to change the content length because this is the important
part so i'm going to put this at 900. so the what's going to happen here is the
request is going to be sent the web server is going to see this
first request as chunked it's then going
to process that but then it's going to also process your second request here
and what's actually going to happen is the next user that uses the website
their http request is going to be appended to this comment section
because the web server thinks that their request should be appended to ours
because we've not like closed the connection kind of thing and
that's why it's vulnerable so if i go ahead and send that
we get a protocol error and that is because i've made a mistake and not put
http here
so if we go ahead and send that we get a 200. sorry about that
if i then refresh the website you'll see in the comments section now sometimes it
takes a couple of goes to do this because obviously you need to kind of
match when another user is using the website
okay so that doesn't seem to work so maybe the content length is a bit too
much if we go 800 here and send that instead
there we go we can now see that quite clearly here we've received our
x's which we've put here and also some other web request here
where we can see there's a secret cookie from the victim so we know it's the
right thing and we can see a session token here
but we know that's not actually correct because a session token isn't that small
so we need to up the session uh sorry up the content length a little
bit more to try and get some more information back there
so 810 wasn't correct either let's go with 808
802
okay so 802 seems to have worked so we'll just grab that session token which
is what's the what the victim user has obviously tried to send
and then we need to try and log in as that user to solve this lab so we can do
that just simply by going to my account and just logging in as some other user
so just putting some test data there log in and change the session
token to that of the one we've just stolen forward it
refresh and we've solved the lab so as you can
see there what we've done is we've tripped the back end web server into
gaining back another victim users http request
in the blog post from using that comment parameter
so we've gained the user session here within what our comment was
i hope that all makes sense it's a bit confusing but i i think that was uh
explained fairly well hope you do too thanks for watching guys that's http
request smuggling