Loading video...

Video Failed to Load

Go Home

CL.TE request smuggling works when front-end and back-end disagree on where your request ends. The attacker hides a second request in the body of the first. Here's a demo 👇 Practice with PortSwigger's Web Security Academy.

WebSecAcademy's profile picture

Web Security Academy

144,361 subscribers

17,824 views • 2 months ago •via X (Twitter)

LIVE

Anya Rossi• Live Now

Private livecam show

3 Comments

RabiX Security's profile picture
RabiX Security2 months ago

A good reminder that web security isn't only about writing secure code—it's also about understanding how every component processes requests.

Sara Blu's profile picture
Sara Blu2 months ago

Solid demo. CL.TE gets overlooked in telecom security audits but with layered proxy setups in 5G cores, it's critical we test for this.

Steve | Tech Savvy's profile picture
Steve | Tech Savvy2 months ago

Web security starts where protocol assumptions break. If your proxy and origin server disagree on request boundaries, attackers will gladly take advantage. Great demo.

Related Videos

HTTP Request Smuggling Lab Walkthrough: Confirming a CL.TE vulnerability via differential responses. How to identify CLTE Vulnerabilities: 1. Send request to repeater 2. Downgrade protocol to HTTP/1.1 3. Disable "Update Content-Length" 4. Set Content-Length to 6 5. Add "Transfer-Encoding: chunked" heading 6. Send a chunk with an invalid chunk size If the backend times out, this indicates a potential CLTE vulnerability. Confirm the vulnerability with differential responses: 7. Create and send the attack request: - Replace previous chunk with a terminating chunk. - Add a smuggled request after the chunked body. - Append X-ignore: X (without a newline) and send. 8. Send a normal request to repeater, downgrade to HTTP/1.1 and send immediately after the attack request. If the response to the normal request is 404 instead of 200, the backend was poisoned! 🤮 Well done! To learn more about HTTP Request Smuggling and take on this lab yourself, head over the the Web Security Academy now #requestsmuggling #pentesting #bugbounty #hacking #cybersecurity
1:32

HTTP Request Smuggling Lab Walkthrough: Confirming a CL.TE vulnerability via differential responses. How to identify CLTE Vulnerabilities: 1. Send request to repeater 2. Downgrade protocol to HTTP/1.1 3. Disable "Update Content-Length" 4. Set Content-Length to 6 5. Add "Transfer-Encoding: chunked" heading 6. Send a chunk with an invalid chunk size If the backend times out, this indicates a potential CLTE vulnerability. Confirm the vulnerability with differential responses: 7. Create and send the attack request: - Replace previous chunk with a terminating chunk. - Add a smuggled request after the chunked body. - Append X-ignore: X (without a newline) and send. 8. Send a normal request to repeater, downgrade to HTTP/1.1 and send immediately after the attack request. If the response to the normal request is 404 instead of 200, the backend was poisoned! 🤮 Well done! To learn more about HTTP Request Smuggling and take on this lab yourself, head over the the Web Security Academy now #requestsmuggling #pentesting #bugbounty #hacking #cybersecurity

Web Security Academy

26,360 views • 1 year ago

Railway employee entered a coach and made a announcement and everybody in the coach clapped and supported his request. Sometimes simple request and appreciation works well than using force.
1:07

Railway employee entered a coach and made a announcement and everybody in the coach clapped and supported his request. Sometimes simple request and appreciation works well than using force.

Woke Eminent

886,966 views • 11 months ago

Voice request to an OpenHome speaker. A local AI books a real Delta flight end to end on a fresh Minisforum X1 iGPU. No human clicks. No cloud agent. 73 seconds. The video is the demo. Numbers below. 🧵
1:12

Voice request to an OpenHome speaker. A local AI books a real Delta flight end to end on a fresh Minisforum X1 iGPU. No human clicks. No cloud agent. 73 seconds. The video is the demo. Numbers below. 🧵

cCross

524,633 views • 4 months ago

For the first time in 16 years, a new HTTP method (like POST) is added: Method QUERY. This is cacheable by CDNs, like GET requests, but allows a body in the request. Talking about this in detail today, and a hot take on this at the end.
19:45

For the first time in 16 years, a new HTTP method (like POST) is added: Method QUERY. This is cacheable by CDNs, like GET requests, but allows a body in the request. Talking about this in detail today, and a hot take on this at the end.

Mehul Mohan

35,968 views • 2 months ago

Nothing gives me energy at the end of a long practice session quite like a request for happy birthday ❤️ Also: LISTEN TO THIS ORGAN. Hard to describe how spectacular it sounds in the building.
1:07

Nothing gives me energy at the end of a long practice session quite like a request for happy birthday ❤️ Also: LISTEN TO THIS ORGAN. Hard to describe how spectacular it sounds in the building.

Anna Lapwood

22,193 views • 2 years ago

Why use five tools when you only need one? 👀 Lefty integrates every step of the gifting process: you can add your products, identify the right talent, handle delivery, and sync with your existing tech stack. It’s end-to-end automation designed for the modern marketer. Send us a demo request to become a one: #marketer #seeding #gifting #influencemarketing #ugc #influencermarketing #marketing #ugc #lefty
1:17

Why use five tools when you only need one? 👀 Lefty integrates every step of the gifting process: you can add your products, identify the right talent, handle delivery, and sync with your existing tech stack. It’s end-to-end automation designed for the modern marketer. Send us a demo request to become a one: #marketer #seeding #gifting #influencemarketing #ugc #influencermarketing #marketing #ugc #lefty

Lefty.io

10,841 views • 6 months ago

Everyone has been asking me for a video of Tiger Woods in the back of a police car, yawning and dealing with the hiccups. I’m happy to satisfy your request. Enjoy!
1:07

Everyone has been asking me for a video of Tiger Woods in the back of a police car, yawning and dealing with the hiccups. I’m happy to satisfy your request. Enjoy!

Dr. Jebra Faushay

13,692 views • 5 months ago

" Sometimes the deserving doesn't get the deserving end " :) 2023 🏆 A request to bcci selectors to select the same team and energy. #ChampionsTrophy2025
0:59

" Sometimes the deserving doesn't get the deserving end " :) 2023 🏆 A request to bcci selectors to select the same team and energy. #ChampionsTrophy2025

𝙅𝙍 𝟕𝟕

67,076 views • 1 year ago

Dono request for a cutie: "Stuffing with tiny vore at the end?" I took this very literally..~ 🤭✨️✨️
2:10

Dono request for a cutie: "Stuffing with tiny vore at the end?" I took this very literally..~ 🤭✨️✨️

Gummy (they/them) 🖤🤍💚🤍🖤

14,561 views • 5 months ago

Use your voice to engage in a back-and-forth conversation with ChatGPT. Speak with it on the go, request a bedtime story, or settle a dinner table debate. Sound on 🔊
1:41

Use your voice to engage in a back-and-forth conversation with ChatGPT. Speak with it on the go, request a bedtime story, or settle a dinner table debate. Sound on 🔊

OpenAI

4,115,757 views • 3 years ago

INSANE: Cursor + MCP just built a customer-requested feature end-to-end!! Our customer sent us a slack message requesting for a feature. Cursor read this, built the feature and created a Pull Request, all on its own! Here's how you can set it up, - Go to Composio's MCP directory - Search for Slack and Github, copy the sse url - Complete Auth with both of these apps - Let Cursor fetch your Slack Messages, Build the feature and Create a Pull Request Customers are happier than even before and engineers can focus on long term stuff!! All you need is
1:33

INSANE: Cursor + MCP just built a customer-requested feature end-to-end!! Our customer sent us a slack message requesting for a feature. Cursor read this, built the feature and created a Pull Request, all on its own! Here's how you can set it up, - Go to Composio's MCP directory - Search for Slack and Github, copy the sse url - Complete Auth with both of these apps - Let Cursor fetch your Slack Messages, Build the feature and Create a Pull Request Customers are happier than even before and engineers can focus on long term stuff!! All you need is

Karan Vaidya

166,209 views • 1 year ago

Heart breaking videos of Diogo Jota accident .The crash was so severe that high end car with all the safety features was under fire within a second in Spain . RIP Liverpool and Portugal footballer .Request all your family member to drive within feasible speed limit 🙏#DiagoJota
0:55

Heart breaking videos of Diogo Jota accident .The crash was so severe that high end car with all the safety features was under fire within a second in Spain . RIP Liverpool and Portugal footballer .Request all your family member to drive within feasible speed limit 🙏#DiagoJota

Amockk

512,161 views • 1 year ago

The end of lugging your bike up the stairs to your fifth-floor walkup is near 😤 NYC DOT is bringing 500 secure bike parking lockers to New York City's streets by the end of 2027! And there's still time to request one for your block 👇
2:04

The end of lugging your bike up the stairs to your fifth-floor walkup is near 😤 NYC DOT is bringing 500 secure bike parking lockers to New York City's streets by the end of 2027! And there's still time to request one for your block 👇

Streetsblog New York City

42,938 views • 2 months ago

Mojo Brookzz request a contract with the Warriors after beating Jimmy in a game of 1 on 1
2:01

Mojo Brookzz request a contract with the Warriors after beating Jimmy in a game of 1 on 1

warriorsworld

65,218 views • 25 days ago

This Uber driver allegedly asked one of the female passengers to move and sit in the front seat. When another passenger questioned the request, a heated exchange of words reportedly followed. 😭
1:35

This Uber driver allegedly asked one of the female passengers to move and sit in the front seat. When another passenger questioned the request, a heated exchange of words reportedly followed. 😭

Vehicle Trackers

710,084 views • 3 months ago

The new #HelloNeighbor3 Dev Diary is here. Take a look at the current development state, learn more about the real-life Raven Brooks and how our AI works and request your access to the first Hello Neighbor 3 prototype. Follow the link in the replies. 👇
13:19

The new #HelloNeighbor3 Dev Diary is here. Take a look at the current development state, learn more about the real-life Raven Brooks and how our AI works and request your access to the first Hello Neighbor 3 prototype. Follow the link in the replies. 👇

Hello Neighbor - Official

19,487 views • 1 year ago