Loading video...

Video Failed to Load

Go Home

Want to find HTTP Request Smuggling vulns without manually crafting weird requests? Check out HTTP Request Smuggler, a Burp Suite extension that automates it for you! Learn more:

WebSecAcademy's profile picture

Web Security Academy

138,397 subscribers

11,696 views • 1 year ago •via X (Twitter)

LIVE

Anya Rossi• Live Now

Private livecam show

0 Comments

No comments available

Comments from the original post will appear here

Related Videos

What is HTTP Downgrading, why use it, and how does it work? HTTP/2 is default for most web apps these days, however, it's not uncommon for backend servers to still use HTTP/1.1 causing parsing mismatches between frontend and backend. And that's where HTTP downgrading comes in! But what is it? HTTP downgrading is the process of forcing a request to be processed under HTTP/1.1 instead of HTTP/2. This allows you to manipulate how the frontend and backend servers interpret requests and exploit vulnerabilities unique to HTTP/1.1 parsing such as Content-Length Transfer-Encoding (CL.TE) attacks. How to downgrade HTTP/2 to HTTP/1.1 using Burp Suite 1️⃣ Open Burp Suite and Navigate to Proxy → HTTP History 2️⃣ Locate the request that is currently using HTTP/2. 3️⃣ Send the Request to Repeater 4️⃣ In the Repeater tab, open the "Inspector" panel → Request Attributes → Protocol 5️⃣ Change HTTP Version to HTTP/1.1 6️⃣ Click "Send" in Repeater. If successful, you should receive a valid response, confirming the server accepts HTTP/1.1. And that's it! You've just downgraded the HTTP protocol and confirmed that the frontend server accepts HTTP/1.1! 🥳 You are now ready to smuggle requests! If you want to learn how to exploit this, we've got a Web Academy Lab you need to check out: Thanks for reading! #requestsmuggling #cybersecurity #BurpSuite #hacking #infosec
0:28

What is HTTP Downgrading, why use it, and how does it work? HTTP/2 is default for most web apps these days, however, it's not uncommon for backend servers to still use HTTP/1.1 causing parsing mismatches between frontend and backend. And that's where HTTP downgrading comes in! But what is it? HTTP downgrading is the process of forcing a request to be processed under HTTP/1.1 instead of HTTP/2. This allows you to manipulate how the frontend and backend servers interpret requests and exploit vulnerabilities unique to HTTP/1.1 parsing such as Content-Length Transfer-Encoding (CL.TE) attacks. How to downgrade HTTP/2 to HTTP/1.1 using Burp Suite 1️⃣ Open Burp Suite and Navigate to Proxy → HTTP History 2️⃣ Locate the request that is currently using HTTP/2. 3️⃣ Send the Request to Repeater 4️⃣ In the Repeater tab, open the "Inspector" panel → Request Attributes → Protocol 5️⃣ Change HTTP Version to HTTP/1.1 6️⃣ Click "Send" in Repeater. If successful, you should receive a valid response, confirming the server accepts HTTP/1.1. And that's it! You've just downgraded the HTTP protocol and confirmed that the frontend server accepts HTTP/1.1! 🥳 You are now ready to smuggle requests! If you want to learn how to exploit this, we've got a Web Academy Lab you need to check out: Thanks for reading! #requestsmuggling #cybersecurity #BurpSuite #hacking #infosec

Web Security Academy

62,759 views • 1 year ago

How to manually check for CL.TE Request Smuggling Vulnerabilities: 1️⃣ See if a GET request accepts POST 2️⃣ See if it accepts HTTP/1 3️⃣ Disable "Update Content-Length" 4️⃣ Send with CL & TE headers: POST / HTTP/1.1 Host: Content-Length: 6 Transfer-Encoding: chunked 0 G 5️⃣ Send request twice. If you receive a response like "Unrecognized method GPOST", you've just confirmed a CL.TE vulnerability! Try this out for yourself in our CL.TE lab:
0:30

How to manually check for CL.TE Request Smuggling Vulnerabilities: 1️⃣ See if a GET request accepts POST 2️⃣ See if it accepts HTTP/1 3️⃣ Disable "Update Content-Length" 4️⃣ Send with CL & TE headers: POST / HTTP/1.1 Host: Content-Length: 6 Transfer-Encoding: chunked 0 G 5️⃣ Send request twice. If you receive a response like "Unrecognized method GPOST", you've just confirmed a CL.TE vulnerability! Try this out for yourself in our CL.TE lab:

Web Security Academy

27,993 views • 1 year ago

HTTP Request Smuggling Lab Walkthrough: Confirming a CL.TE vulnerability via differential responses. How to identify CLTE Vulnerabilities: 1. Send request to repeater 2. Downgrade protocol to HTTP/1.1 3. Disable "Update Content-Length" 4. Set Content-Length to 6 5. Add "Transfer-Encoding: chunked" heading 6. Send a chunk with an invalid chunk size If the backend times out, this indicates a potential CLTE vulnerability. Confirm the vulnerability with differential responses: 7. Create and send the attack request: - Replace previous chunk with a terminating chunk. - Add a smuggled request after the chunked body. - Append X-ignore: X (without a newline) and send. 8. Send a normal request to repeater, downgrade to HTTP/1.1 and send immediately after the attack request. If the response to the normal request is 404 instead of 200, the backend was poisoned! 🤮 Well done! To learn more about HTTP Request Smuggling and take on this lab yourself, head over the the Web Security Academy now #requestsmuggling #pentesting #bugbounty #hacking #cybersecurity
1:32

HTTP Request Smuggling Lab Walkthrough: Confirming a CL.TE vulnerability via differential responses. How to identify CLTE Vulnerabilities: 1. Send request to repeater 2. Downgrade protocol to HTTP/1.1 3. Disable "Update Content-Length" 4. Set Content-Length to 6 5. Add "Transfer-Encoding: chunked" heading 6. Send a chunk with an invalid chunk size If the backend times out, this indicates a potential CLTE vulnerability. Confirm the vulnerability with differential responses: 7. Create and send the attack request: - Replace previous chunk with a terminating chunk. - Add a smuggled request after the chunked body. - Append X-ignore: X (without a newline) and send. 8. Send a normal request to repeater, downgrade to HTTP/1.1 and send immediately after the attack request. If the response to the normal request is 404 instead of 200, the backend was poisoned! 🤮 Well done! To learn more about HTTP Request Smuggling and take on this lab yourself, head over the the Web Security Academy now #requestsmuggling #pentesting #bugbounty #hacking #cybersecurity

Web Security Academy

26,360 views • 1 year ago

#Roblox #RobloxDev Facial Unification is a non-HTTP module which converts Dynamic Faces to their classic 2D variants. It works without HTTP request, it's linked as a package so it will stay up-to-date with my manual changes. LINK:
0:37

#Roblox #RobloxDev Facial Unification is a non-HTTP module which converts Dynamic Faces to their classic 2D variants. It works without HTTP request, it's linked as a package so it will stay up-to-date with my manual changes. LINK:

Dogutsune

483,085 views • 7 months ago

Have you tried Shadow Repeater? It's an AI-powered Extension for Burp Repeater that auto-mutates requests, does intelligent fuzzes in the background, and surfaces surprising findings to Burp Organizer, helping to uncover bypasses and hidden attack paths faster. Learn more 👇
0:28

Have you tried Shadow Repeater? It's an AI-powered Extension for Burp Repeater that auto-mutates requests, does intelligent fuzzes in the background, and surfaces surprising findings to Burp Organizer, helping to uncover bypasses and hidden attack paths faster. Learn more 👇

Burp Suite

12,147 views • 7 months ago

Yeeeeah you could manually figure out a payload for DOM XSS... or you could just ask Burp AI to do it for you.
0:55

Yeeeeah you could manually figure out a payload for DOM XSS... or you could just ask Burp AI to do it for you.

Burp Suite

19,365 views • 10 months ago

Supabase now provides a free easy-to-use corn job scheduler! Configure the job from the dashboard and set it to send an HTTP request or call a database or edge function periodically! View the history of the past jobs that it ran so that you can debug when something goes wrong!
0:34

Supabase now provides a free easy-to-use corn job scheduler! Configure the job from the dashboard and set it to send an HTTP request or call a database or edge function periodically! View the history of the past jobs that it ran so that you can debug when something goes wrong!

Tyler Shukert

24,247 views • 1 year ago

I did a thing guys. I built a Burp Suite extension that lets you: 1. Import Postman collections (REST & GraphQL) 2. Load directly into Repeater or Sitemap 3. Retain request names 4. Auto-resolve Postman variables And other nice features It's free and OS
2:01

I did a thing guys. I built a Burp Suite extension that lets you: 1. Import Postman collections (REST & GraphQL) 2. Load directly into Repeater or Sitemap 3. Retain request names 4. Auto-resolve Postman variables And other nice features It's free and OS

༒Nerdy ᭄Genii࿐★

22,918 views • 1 year ago

How to Find Path Delimiter Issues with Burp Suite Intruder Sometimes web servers treat special characters (like ; or ?) differently in URLs. This can lead to security issues like web cache deception or access control problems. Here's how you can test for path delimiter discrepancies: 1️⃣ Capture the Request Find a request you want to test GET /my-account HTTP/2 2️⃣ Right click the request and "Send to Intruder". In Intruder, highlight add a new position after /my-account followed by abc. It should look like this: GET /my-account§§abc HTTP/2 Attack Type = Sniper (only changing one spot). Payload: Paste a list of special characters, like this: ! # $ % & ' ( ) * + , - . / : ; = ? @ [ \ ] _ ~ ... A full list of delimiters can be found here: 3️⃣ Start the Attack Press Start Attack. Look at the Status, Length, and Response columns. Watch for differences (like bigger/smaller pages, changes to status code or different behavior) and if you notice something different then you've likely found a delimiter discrepancy! 🎉 Why is this important? When special characters confuse the server or cache, you might find: 🔸 Web cache deception: Caching personal pages by accident 🔸 Access bypass: Skipping security checks 🔸 Leaked info: Seeing data you shouldn't Try this lab for yourself and dive even deeper into how to exploit this when you find it: #BugBounty #WebSecurity #BurpSuite #EthicalHacking #Cybersecurity
0:27

How to Find Path Delimiter Issues with Burp Suite Intruder Sometimes web servers treat special characters (like ; or ?) differently in URLs. This can lead to security issues like web cache deception or access control problems. Here's how you can test for path delimiter discrepancies: 1️⃣ Capture the Request Find a request you want to test GET /my-account HTTP/2 2️⃣ Right click the request and "Send to Intruder". In Intruder, highlight add a new position after /my-account followed by abc. It should look like this: GET /my-account§§abc HTTP/2 Attack Type = Sniper (only changing one spot). Payload: Paste a list of special characters, like this: ! # $ % & ' ( ) * + , - . / : ; = ? @ [ \ ] _ ~ ... A full list of delimiters can be found here: 3️⃣ Start the Attack Press Start Attack. Look at the Status, Length, and Response columns. Watch for differences (like bigger/smaller pages, changes to status code or different behavior) and if you notice something different then you've likely found a delimiter discrepancy! 🎉 Why is this important? When special characters confuse the server or cache, you might find: 🔸 Web cache deception: Caching personal pages by accident 🔸 Access bypass: Skipping security checks 🔸 Leaked info: Seeing data you shouldn't Try this lab for yourself and dive even deeper into how to exploit this when you find it: #BugBounty #WebSecurity #BurpSuite #EthicalHacking #Cybersecurity

Web Security Academy

18,152 views • 1 year ago

HTTP is supposed to be stateless, but sometimes... it isn't! Some servers create invisible vulnerabilities by only validating the first request on each TCP/TLS connection. I've just published a Custom Action to help you detect & exploit this - here's a narrated demo:
3:23

HTTP is supposed to be stateless, but sometimes... it isn't! Some servers create invisible vulnerabilities by only validating the first request on each TCP/TLS connection. I've just published a Custom Action to help you detect & exploit this - here's a narrated demo:

James Kettle

140,126 views • 10 months ago

👀Bruno's new VS Code extension 💥 is here! Access your existing collections, requests, and environments or spin up an ad hoc request without leaving the IDE! Give it a try and let us know what you think!
0:21

👀Bruno's new VS Code extension 💥 is here! Access your existing collections, requests, and environments or spin up an ad hoc request without leaving the IDE! Give it a try and let us know what you think!

Bruno

13,137 views • 1 year ago

We're excited to partner with Coinbase 🛡️ to enable agents to natively pay for web search, via x402! x402 is an open protocol that enables agents to pay via HTTP, governed by the Linux Foundation. When an Exa API request is made without an API key, Exa now returns a 402 status code with payment information that an agent can act on.
1:26

We're excited to partner with Coinbase 🛡️ to enable agents to natively pay for web search, via x402! x402 is an open protocol that enables agents to pay via HTTP, governed by the Linux Foundation. When an Exa API request is made without an API key, Exa now returns a 402 status code with payment information that an agent can act on.

Exa

246,159 views • 4 months ago

Got a chance to check out the new store in Hollywood! They have this new tech that lets you verify your identity as a human! Check it out here learn more and find an Orb near you! #ad #world #worldid #samaltman #worldregion
0:56

Got a chance to check out the new store in Hollywood! They have this new tech that lets you verify your identity as a human! Check it out here learn more and find an Orb near you! #ad #world #worldid #samaltman #worldregion

iJustine

27,075 views • 1 year ago

Check my OF for other packages options 🤭😈. I promise you’ll find the one that suits you, or you can request me a personal too 😈😈😈
0:22

Sensitive content

Check my OF for other packages options 🤭😈. I promise you’ll find the one that suits you, or you can request me a personal too 😈😈😈

Vikingoat

20,281 views • 3 years ago

You live, you learn! Want to find out more about Delta Force? Check out the clip review from the GOAT himself — mister Leissik! TLDR: Alliance plays smart 😎
1:02

You live, you learn! Want to find out more about Delta Force? Check out the clip review from the GOAT himself — mister Leissik! TLDR: Alliance plays smart 😎

Alliance

128,958 views • 23 days ago

Every 3rd website you visit runs Nginx. 18,959,833 of them can be hijacked right now. A bug from 2008 just got a working exploit. CVE-2026-42945 (CVSS 9.2) No login. No access. Just one HTTP request. → Heap overflow → Worker process → RCE Patch ASAP to Nginx 1.31.0 or 1.30.1 PoC is already out:
0:36

Every 3rd website you visit runs Nginx. 18,959,833 of them can be hijacked right now. A bug from 2008 just got a working exploit. CVE-2026-42945 (CVSS 9.2) No login. No access. Just one HTTP request. → Heap overflow → Worker process → RCE Patch ASAP to Nginx 1.31.0 or 1.30.1 PoC is already out:

Het Mehta

152,793 views • 3 months ago

I still find it weird the guy -That was always recruiting player to CLE -That begged for Myles to rescind his trade request -That dug his roots into this city Announced he’s leaving 4 months after saying he never will What happened?
0:41

I still find it weird the guy -That was always recruiting player to CLE -That begged for Myles to rescind his trade request -That dug his roots into this city Announced he’s leaving 4 months after saying he never will What happened?

Mac🦬

1,409,041 views • 6 months ago

If Burp Suite finds the bugs, Bambdas make them history! You can write Java-based Bambdas to create custom filters for your HTTP history. Explore a variety of Bambda scripts, some written by me and others shared by our community, at You can browse the scripts using arrow keys and quickly copy any Bambda script to your clipboard with a press of 'C'. Compatible with both Burp Suite Community Edition and Professional. We're currently optimized for desktop browsers and are working on an Electron-based desktop app for a more integrated experience. 🔧 Got a bug to report or an idea to share? Please let us know on GitHub: #bugbounty #Bambdas
0:34

If Burp Suite finds the bugs, Bambdas make them history! You can write Java-based Bambdas to create custom filters for your HTTP history. Explore a variety of Bambda scripts, some written by me and others shared by our community, at You can browse the scripts using arrow keys and quickly copy any Bambda script to your clipboard with a press of 'C'. Compatible with both Burp Suite Community Edition and Professional. We're currently optimized for desktop browsers and are working on an Electron-based desktop app for a more integrated experience. 🔧 Got a bug to report or an idea to share? Please let us know on GitHub: #bugbounty #Bambdas

Tur.js

24,194 views • 2 years ago