Protocol-level HTTP flaws: request smuggling and cache poisoning
You safely recognise flaws born when the front end and back end read a request differently, and from cache rules, in your own CDN–proxy–app chain, close them with protocol and cache settings and watch for anomalies in the logs.
Level 401 · 14 lessons · 12 practice labs
Lessons
Request smuggling
- Front-end and back-end disagreement: Content-Length and Transfer-Encoding
- CL.TE, TE.CL and TE.TE variants
- Flaws born when HTTP/2 is downgraded to HTTP/1.1
- Recognising smuggling safely in your own chain
- The fix: end-to-end HTTP/2 and rejecting ambiguous requests
- Short task: evidence and close a CL.TE flaw in the lab proxy–app chain
Caching
- Cache keys, unkeyed inputs and Vary
- Web cache poisoning: corrupting a response through an unkeyed header
- Web cache deception: a private page ending up in the cache
- Designing cache rules safely
- Short task: evidence the cache deception in the lab CDN and fix the rule
Detection
- Spotting protocol anomalies in proxy and CDN logs
- Blocking ambiguous requests at the WAF and proxy
- Capstone: harden a CDN–proxy–app chain against protocol-level flaws
Practice labs
- How front end and back end see the same request: Compare how the proxy and the app in the lab chain parse the same request differently in their logs.
- Recognise CL.TE safely in your chain: Confirm the CL.TE disagreement in the lab chain with a timing test that affects only your own request.
- A flaw in HTTP/2 to HTTP/1.1 translation: Show in the lab the ambiguity the front end creates when translating an HTTP/2 request to HTTP/1.1 and fix the proxy setting.
- Refuse ambiguous requests: Configure the chain to refuse requests carrying both Content-Length and Transfer-Encoding and prove smuggling is closed.
- What is in the cache key: Work out from response headers which inputs go into the lab cache's key and which do not.
- Cache deception: the profile page: Prove a personal page lands in the cache through a path that looks like a static file and fix the cache rule.
- Poisoning through an unkeyed header: Show in the lab that an unkeyed header changes the response and gets cached and add the header to the key or ignore it.
- Design safe cache rules: Write separate cache rules for personal and public content, fix Vary and Cache-Control and test there is no leak after logout.
- A protocol anomaly in the proxy log: Find requests with duplicate length headers and malformed chunked encoding in the proxy log.
- A WAF rule for ambiguous requests: Write a WAF rule that blocks protocol-level ambiguous requests and test that it does not break legitimate traffic.
- Catch cache poisoning from the logs: Derive a poisoning suspicion from changing response sizes for the same key in the CDN log and set an alert.
- Harden a CDN-proxy-app chain: Close the smuggling and cache flaws in the fictional Ostria Media chain, add detection rules and retest.
About this course
You safely recognise flaws born when the front end and back end read a request differently, and from cache rules, in your own CDN–proxy–app chain, close them with protocol and cache settings and watch for anomalies in the logs.
What you will learn
- Request smuggling
- Caching
- Detection
Prerequisites
You should have practised the topics of the same path up to level 301.
Lab environment
Lessons run on your own Kali Linux desktop in the browser, with the tools ready in their windowed interfaces. Nothing to install; a computer screen is recommended.
Frequently asked questions
- Is this course right for my level?
- The course is at level 401; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.