HTTP Request Smuggling

HTTP request smuggling (also called HTTP desynchronization) is a class of attack against multi-tier web architectures in which an attacker sends an ambiguous HTTP request that a front-end and back-end server disagree about — specifically about where the request ends. The back-end is left with a malicious “prefix” in its socket buffer, which is then prepended to the next legitimate user’s request, letting the attacker splice arbitrary content into other users’ requests.¹²

The technique was first documented in 2004 but was largely forgotten until James Kettle (PortSwigger) revived and massively extended it in his 2019 paper HTTP Desync Attacks: Request Smuggling Reborn, presented at Black Hat USA and DEF CON — earning $70k+ in bug bounties from commercial and military targets.³

Root cause: framing ambiguity

HTTP/1.1 has two ways to delimit a request body:⁴

• Content-Length: N — the body is N bytes long
• Transfer-Encoding: chunked — the body is a series of size-prefixed chunks, terminated by a zero-length chunk

If a front-end and back-end use different mechanisms for the same request, the back-end may interpret the “body” as containing a complete second request. RFC 9112 says a message containing both headers MUST have Transfer-Encoding override — but real servers are inconsistent, and the discrepancy is the vulnerability.⁵⁶

Classic variants

• CL.TE — front-end uses Content-Length, back-end uses Transfer-Encoding⁷
• TE.CL — front-end uses Transfer-Encoding, back-end uses Content-Length⁸
• TE.TE — both use chunked encoding, but one can be induced to ignore it via header obfuscation (e.g. duplicate headers, whitespace tricks, Transfer-Encoding: xchunked)⁹

Later research extended the family: HTTP/2: The Sequel is Always Worse (HTTP/2→HTTP/1.1 downgrading desyncs),¹⁰ Browser-Powered Desync Attacks,¹¹ and HTTP/1.1 Must Die: The Desync Endgame (0.CL attacks, client-side desyncs — arguing smuggling is a fundamental protocol flaw in HTTP/1.1).¹²

Impact

• Prepend attacker content to other users’ requests (credential/cookie capture, request poisoning)¹³
• Bypass front-end security controls and reach internal APIs¹⁴
• Poison web caches to persistently compromise pages (e.g. login pages — PayPal’s was compromised twice)¹⁵
• Mass credential compromise via client-side desync¹⁶

Detection and tooling

The standard detection method is a time-based differential: send requests that will time out on the back-end only if a desync occurred, using a safe detection method that avoids poisoning real users.¹⁷ PortSwigger’s open-source HTTP Request Smuggler Burp extension automates this (“smuggle probe”), with follow-up “CL.TE Attack”/“TE.CL Attack” confirmation options; it uses Burp Collaborator for out-of-band confirmation.¹⁸ See the PortSwigger Web Security Academy topic for labs and methodology,¹⁹ and the broader request smuggling research index.²⁰

See also

• http — HTTP/1.1 framing (Content-Length vs Transfer-Encoding)
• turbo-intruder — the tooling Kettle built for the billion-request attacks that accompany this research
• burp-suite-firefox / burp-suite-mobile-apps — intercepting traffic with Burp

Sources

• PortSwigger Research — HTTP Desync Attacks: Request Smuggling Reborn (James Kettle, 2019)
• PortSwigger Research — HTTP Request Smuggling research index
• PortSwigger Web Security Academy — HTTP request smuggling
• PortSwigger Research — HTTP/1.1 Must Die: The Desync Endgame (James Kettle, 2025)
• PortSwigger Research — HTTP/2: The Sequel is Always Worse (James Kettle, 2021)
• PortSwigger Research — Browser-Powered Desync Attacks (James Kettle, 2022)
• PortSwigger HTTP Request Smuggler — Burp extension

Footnotes

1. PortSwigger Research — HTTP Desync Attacks: Request Smuggling Reborn (James Kettle, 2019) ↩

2. PortSwigger Web Security Academy — HTTP request smuggling ↩

3. PortSwigger Research — HTTP Desync Attacks: Request Smuggling Reborn (James Kettle, 2019) ↩

4. PortSwigger Web Security Academy — HTTP request smuggling ↩

5. PortSwigger Research — HTTP Desync Attacks: Request Smuggling Reborn (James Kettle, 2019) ↩

6. PortSwigger Web Security Academy — HTTP request smuggling ↩

7. PortSwigger Web Security Academy — HTTP request smuggling ↩

8. PortSwigger Web Security Academy — HTTP request smuggling ↩

9. PortSwigger Web Security Academy — HTTP request smuggling ↩

10. PortSwigger Research — HTTP/2: The Sequel is Always Worse (James Kettle, 2021) ↩

11. PortSwigger Research — Browser-Powered Desync Attacks (James Kettle, 2022) ↩

12. PortSwigger Research — HTTP/1.1 Must Die: The Desync Endgame (James Kettle, 2025) ↩

13. PortSwigger Research — HTTP Desync Attacks: Request Smuggling Reborn (James Kettle, 2019) ↩

14. PortSwigger Research — HTTP Desync Attacks: Request Smuggling Reborn (James Kettle, 2019) ↩

15. PortSwigger Research — HTTP Desync Attacks: Request Smuggling Reborn (James Kettle, 2019) ↩

16. PortSwigger Research — Browser-Powered Desync Attacks (James Kettle, 2022) ↩

17. PortSwigger Research — HTTP Desync Attacks: Request Smuggling Reborn (James Kettle, 2019) ↩

18. PortSwigger HTTP Request Smuggler — Burp extension ↩

19. PortSwigger Web Security Academy — HTTP request smuggling ↩

20. PortSwigger Research — HTTP Request Smuggling research index ↩