From d5aed653e8dff01e15e338686954f01120b60876 Mon Sep 17 00:00:00 2001 From: Dhmos Funk <45040001+dhmosfunk@users.noreply.github.com> Date: Wed, 14 Sep 2022 18:05:31 +0300 Subject: [PATCH 1/2] Update README.md --- Request Smuggling/README.md | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/Request Smuggling/README.md b/Request Smuggling/README.md index 3f145a0..a8dd41c 100644 --- a/Request Smuggling/README.md +++ b/Request Smuggling/README.md @@ -1,5 +1,13 @@ # Request Smuggling + +### Introduction + + + + + + ## Summary * [Tools](#tools) From b4e7add674bcce8eaa4642635dff43b8a2032b75 Mon Sep 17 00:00:00 2001 From: Dhmos Funk <45040001+dhmosfunk@users.noreply.github.com> Date: Fri, 16 Sep 2022 02:30:57 +0300 Subject: [PATCH 2/2] add simple http smuggler generator for easiest manually exploitation --- Request Smuggling/README.md | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/Request Smuggling/README.md b/Request Smuggling/README.md index a8dd41c..07b2944 100644 --- a/Request Smuggling/README.md +++ b/Request Smuggling/README.md @@ -1,13 +1,5 @@ # Request Smuggling - -### Introduction - - - - - - ## Summary * [Tools](#tools) @@ -20,6 +12,15 @@ * [HTTP Request Smuggler / BApp Store](https://portswigger.net/bappstore/aaaa60ef945341e8a450217a54a11646) * [Smuggler](https://github.com/defparam/smuggler) +* [Simple HTTP Smuggler Generator CL.TE TE.CL](https://github.com/dhmosfunk/simple-http-smuggler-generator) > this tool does not offer automated exploitation. You have to identify the injection point and exploit it manually! + + +## About CL.TE | TE.CL Vulnerabilities +If you want to exploit HTTP Requests Smuggling manually you will face some problems especially in TE.CL vulnerability you have to calculate the chunk size for the second request(malicious request) as portswigger suggests `Manually fixing the length fields in request smuggling attacks can be tricky.`. For that reason you can use the [Simple HTTP Smuggler Generator CL.TE TE.CL](https://github.com/dhmosfunk/simple-http-smuggler-generator) and exploit the CL.TE TE.CL vulnerabilities manually and learn how this vulnerability works and how you can exploit it. This tool offers you only the second request with a valid chunk size(TE.CL) auto-generated but does not offer automated exploitation. You have to identify the injection point and exploit it manually! + + + + ## CL.TE vulnerabilities