正在加载视频...

视频加载失败

加载此视频时出现问题。这可能是由于临时网络问题，或视频可能不可用。

CL.TE request smuggling works when front-end and back-end disagree on where your request ends. The attacker hides a second request in the body of the first. Here's a demo 👇 Practice with PortSwigger's Web Security Academy.

Web Security Academy

141,921 subscribers

17,396 次观看 • 1 个月前 •via X (Twitter)

Anya Rossi• Live Now

Private livecam show

0 条评论

暂无评论

原始帖子的评论将显示在这里

相关视频

HTTP Request Smuggling Lab Walkthrough: Confirming a CL.TE vulnerability via differential responses. How to identify CLTE Vulnerabilities: 1. Send request to repeater 2. Downgrade protocol to HTTP/1.1 3. Disable "Update Content-Length" 4. Set Content-Length to 6 5. Add "Transfer-Encoding: chunked" heading 6. Send a chunk with an invalid chunk size If the backend times out, this indicates a potential CLTE vulnerability. Confirm the vulnerability with differential responses: 7. Create and send the attack request: - Replace previous chunk with a terminating chunk. - Add a smuggled request after the chunked body. - Append X-ignore: X (without a newline) and send. 8. Send a normal request to repeater, downgrade to HTTP/1.1 and send immediately after the attack request. If the response to the normal request is 404 instead of 200, the backend was poisoned! 🤮 Well done! To learn more about HTTP Request Smuggling and take on this lab yourself, head over the the Web Security Academy now #requestsmuggling #pentesting #bugbounty #hacking #cybersecurity

HTTP Request Smuggling Lab Walkthrough: Confirming a CL.TE vulnerability via differential responses. How to identify CLTE Vulnerabilities: 1. Send request to repeater 2. Downgrade protocol to HTTP/1.1 3. Disable "Update Content-Length" 4. Set Content-Length to 6 5. Add "Transfer-Encoding: chunked" heading 6. Send a chunk with an invalid chunk size If the backend times out, this indicates a potential CLTE vulnerability. Confirm the vulnerability with differential responses: 7. Create and send the attack request: - Replace previous chunk with a terminating chunk. - Add a smuggled request after the chunked body. - Append X-ignore: X (without a newline) and send. 8. Send a normal request to repeater, downgrade to HTTP/1.1 and send immediately after the attack request. If the response to the normal request is 404 instead of 200, the backend was poisoned! 🤮 Well done! To learn more about HTTP Request Smuggling and take on this lab yourself, head over the the Web Security Academy now #requestsmuggling #pentesting #bugbounty #hacking #cybersecurity

Web Security Academy

26,360 次观看 • 1 年前

List price included and a small request at the end 😇 #toolreview #snapon

List price included and a small request at the end 😇 #toolreview #snapon

Val Tools

12,254 次观看 • 1 年前

Railway employee entered a coach and made a announcement and everybody in the coach clapped and supported his request. Sometimes simple request and appreciation works well than using force.

Railway employee entered a coach and made a announcement and everybody in the coach clapped and supported his request. Sometimes simple request and appreciation works well than using force.

Woke Eminent

886,962 次观看 • 9 个月前

Voice request to an OpenHome speaker. A local AI books a real Delta flight end to end on a fresh Minisforum X1 iGPU. No human clicks. No cloud agent. 73 seconds. The video is the demo. Numbers below. 🧵

Voice request to an OpenHome speaker. A local AI books a real Delta flight end to end on a fresh Minisforum X1 iGPU. No human clicks. No cloud agent. 73 seconds. The video is the demo. Numbers below. 🧵

cCross

524,633 次观看 • 3 个月前

For the first time in 16 years, a new HTTP method (like POST) is added: Method QUERY. This is cacheable by CDNs, like GET requests, but allows a body in the request. Talking about this in detail today, and a hot take on this at the end.

For the first time in 16 years, a new HTTP method (like POST) is added: Method QUERY. This is cacheable by CDNs, like GET requests, but allows a body in the request. Talking about this in detail today, and a hot take on this at the end.

Mehul Mohan

35,898 次观看 • 1 个月前

Nothing gives me energy at the end of a long practice session quite like a request for happy birthday ❤️ Also: LISTEN TO THIS ORGAN. Hard to describe how spectacular it sounds in the building.

Nothing gives me energy at the end of a long practice session quite like a request for happy birthday ❤️ Also: LISTEN TO THIS ORGAN. Hard to describe how spectacular it sounds in the building.

Anna Lapwood

22,181 次观看 • 2 年前

Why use five tools when you only need one? 👀 Lefty integrates every step of the gifting process: you can add your products, identify the right talent, handle delivery, and sync with your existing tech stack. It’s end-to-end automation designed for the modern marketer. Send us a demo request to become a one: #marketer #seeding #gifting #influencemarketing #ugc #influencermarketing #marketing #ugc #lefty

Why use five tools when you only need one? 👀 Lefty integrates every step of the gifting process: you can add your products, identify the right talent, handle delivery, and sync with your existing tech stack. It’s end-to-end automation designed for the modern marketer. Send us a demo request to become a one: #marketer #seeding #gifting #influencemarketing #ugc #influencermarketing #marketing #ugc #lefty

Lefty.io

10,841 次观看 • 5 个月前

Everyone has been asking me for a video of Tiger Woods in the back of a police car, yawning and dealing with the hiccups. I’m happy to satisfy your request. Enjoy!

Everyone has been asking me for a video of Tiger Woods in the back of a police car, yawning and dealing with the hiccups. I’m happy to satisfy your request. Enjoy!

Dr. Jebra Faushay

13,692 次观看 • 4 个月前

" Sometimes the deserving doesn't get the deserving end " :) 2023 🏆 A request to bcci selectors to select the same team and energy. #ChampionsTrophy2025

" Sometimes the deserving doesn't get the deserving end " :) 2023 🏆 A request to bcci selectors to select the same team and energy. #ChampionsTrophy2025

𝙅𝙍 𝟕𝟕

65,912 次观看 • 1 年前

Dono request for a cutie: "Stuffing with tiny vore at the end?" I took this very literally..~ 🤭✨️✨️

Dono request for a cutie: "Stuffing with tiny vore at the end?" I took this very literally..~ 🤭✨️✨️

Gummy (they/them) 🖤🤍💚🤍🖤

13,260 次观看 • 3 个月前

Use your voice to engage in a back-and-forth conversation with ChatGPT. Speak with it on the go, request a bedtime story, or settle a dinner table debate. Sound on 🔊

Use your voice to engage in a back-and-forth conversation with ChatGPT. Speak with it on the go, request a bedtime story, or settle a dinner table debate. Sound on 🔊

OpenAI

4,115,193 次观看 • 2 年前

INSANE: Cursor + MCP just built a customer-requested feature end-to-end!! Our customer sent us a slack message requesting for a feature. Cursor read this, built the feature and created a Pull Request, all on its own! Here's how you can set it up, - Go to Composio's MCP directory - Search for Slack and Github, copy the sse url - Complete Auth with both of these apps - Let Cursor fetch your Slack Messages, Build the feature and Create a Pull Request Customers are happier than even before and engineers can focus on long term stuff!! All you need is

INSANE: Cursor + MCP just built a customer-requested feature end-to-end!! Our customer sent us a slack message requesting for a feature. Cursor read this, built the feature and created a Pull Request, all on its own! Here's how you can set it up, - Go to Composio's MCP directory - Search for Slack and Github, copy the sse url - Complete Auth with both of these apps - Let Cursor fetch your Slack Messages, Build the feature and Create a Pull Request Customers are happier than even before and engineers can focus on long term stuff!! All you need is

Karan Vaidya

166,209 次观看 • 1 年前

Heart breaking videos of Diogo Jota accident .The crash was so severe that high end car with all the safety features was under fire within a second in Spain . RIP Liverpool and Portugal footballer .Request all your family member to drive within feasible speed limit 🙏#DiagoJota

Heart breaking videos of Diogo Jota accident .The crash was so severe that high end car with all the safety features was under fire within a second in Spain . RIP Liverpool and Portugal footballer .Request all your family member to drive within feasible speed limit 🙏#DiagoJota

Amockk

512,161 次观看 • 1 年前

The end of lugging your bike up the stairs to your fifth-floor walkup is near 😤 NYC DOT is bringing 500 secure bike parking lockers to New York City's streets by the end of 2027! And there's still time to request one for your block 👇

The end of lugging your bike up the stairs to your fifth-floor walkup is near 😤 NYC DOT is bringing 500 secure bike parking lockers to New York City's streets by the end of 2027! And there's still time to request one for your block 👇

Streetsblog New York City

42,938 次观看 • 28 天前

This Uber driver allegedly asked one of the female passengers to move and sit in the front seat. When another passenger questioned the request, a heated exchange of words reportedly followed. 😭

This Uber driver allegedly asked one of the female passengers to move and sit in the front seat. When another passenger questioned the request, a heated exchange of words reportedly followed. 😭

Vehicle Trackers

709,741 次观看 • 2 个月前

$TSLA I got a lot of request on what to do and when to buy Tesla stock this morning. Here's the exact game plan, step-by-step.

$TSLA I got a lot of request on what to do and when to buy Tesla stock this morning. Here's the exact game plan, step-by-step.

StockWhale

156,129 次观看 • 1 年前

For the first time, the Trump administration has "concrete examples" of the kinds of things Russia would request for an end to the war in Ukraine, Secretary Marco Rubio tells Larry Kudlow.

For the first time, the Trump administration has "concrete examples" of the kinds of things Russia would request for an end to the war in Ukraine, Secretary Marco Rubio tells Larry Kudlow.

Fox News

79,799 次观看 • 1 年前

The new #HelloNeighbor3 Dev Diary is here. Take a look at the current development state, learn more about the real-life Raven Brooks and how our AI works and request your access to the first Hello Neighbor 3 prototype. Follow the link in the replies. 👇

The new #HelloNeighbor3 Dev Diary is here. Take a look at the current development state, learn more about the real-life Raven Brooks and how our AI works and request your access to the first Hello Neighbor 3 prototype. Follow the link in the replies. 👇

Hello Neighbor - Official

19,372 次观看 • 1 年前

In a children's park a child is kicking another child in the face. The first woman is dismissive and ignores the request.

In a children's park a child is kicking another child in the face. The first woman is dismissive and ignores the request.

David Atherton

32,476 次观看 • 2 个月前