Hacking Articles Tips Tricks Videos Tutorials

the dash will become underscore anyway. While determining how to parse the body, such a backend supposedly requests the value of CONTENT_LENGTH / TRANSFER_ENCODING from its headers dictionary, and it will be there. Newlines This one is HTTP/2 specific. As HTTP/2 is a binary protocol, we can try to send newlines in the header name or value. The standard prohibits it, but we hope to find an implementation that still accepts this. During the HTTP/2 -> HTTP/1.1 conversion, the header splits into two different headers, meaning the request will look different for the backend. To smuggle a header, we put its name and value after a newline: a header with the name "Transfer-Encoding" and the value of "chunked" becomes one with the name "fake" with the value of "fake\r\ntransfer-encoding: chunked". UTF characters Suppose the backend uses some high-level language and does not perform enough headers' validation. In that case, it might convert the names to the uppercase before doing anything else and do it using Unicode-aware functions. Luckily, TRANSFER-ENCODING contains the letter S, which is ſ (\u017f) uppercased. Similarly, we can search for a backend that will convert the value of Transfer-Encoding to lowercase: we send chunKed instead of chunked with \u212a instead of K. Of course, it is required that the frontend will pass UTF-8 header names/values to the backend. Usage To install the tool, run go get github.com/neex/http2smugl. The tool contains two subcommands: request and detect. The first one is just for crafting HTTP/2 requests: most client tools do not accept invalid headers, so it's handy to have one that sends user input to the server as-is. The other one it detect. It tries various techniques of HTTP request smuggling to detect if the target is vulnerable. The detection algorithm is complicated; I appreciate it if you read through it and send me your comments. It is described below in the corresponding section. http2smugl request Use this subcommand to send a (probably a bit malformed) http2 request. The first parameter is URL, and the others are just headers in the name:value format (note there's no space after the colon). Backslash escaping is supported: you can use \r,\n and \xXX escape codes. For example, to send a header name that contains a colon, use \x3a (e.g. name\x3awith\x3acolons:value). http2smugl detect This subcommand tries to detect the HTTP request smuggling using various techniques. To use it, just run http2smugl detect [HTTPS URL]. The command will output something only if it could detect that the server parses a smuggled header. To understand what does it mean, please read the corresponding section. HTTP/3 support An experimental support for HTTP/3 (quic) has been implemented. However, I do not suggest using it as I did not find a single bug related to HTTP/3. To use HTTP/3 with request subcommand, provide https+h3:// proto in the URL instead of just https. The same is supported in the detect command. There is also a --try-http3 flag for the request subcommand, which changes the behaviour in case the protocol is not specified in the URL (just hostname). If the flag is present, the command will try https+h3 proto for such entries on the command line or the targets file (as well as HTTP/2). E.g. http2smugl detect --try-http3 www.example.com will try both HTTP/3 and HTTP/2, but http2smugl detect --try-http3 https://www.example.com/ will still try only HTTP/2. Known false-positives In this section, I describe some cases when the tool says the responses are "distinguishable", but no vulnerability could exist. ELB Amazon's Elastic Load Balancer (https://www.kitploit.com/search/label/Load%20Balancer) implements multiple mitigations from HTTP Request Smuggling. While not all of them reject the request by default, ELB won't reuse a connection after sending a request with "suspicious" headers. Thus an actual attack is not possible. To detect you're dealing with ELB, you can use the

___________________________
@hacking_Attack
@Hacking_Video

GitHub

GitHub - neex/http2smugl

Contribute to neex/http2smugl development by creating an account on GitHub.

6 viewsedited 21:08

Hacking Articles Tips Tricks Videos Tutorials

Server response header. If it's filtered out, you can send a request with content__length header (note two underscores) and value -1: if it's 400, it's probably ELB or other WAF (see below). Apache Traffic Server Apache Traffic Server is mainly used at Yahoo. It processes HTTP/2 in an unusual way: it converts it to HTTP/1.1 in memory and then re-parses the resulting request. Thus, while a header technically could be "smuggled", there's no way it will result in a vulnerability: you could send the same bytes to an HTTP/1.1 connection. The easiest way to detect you're dealing with ATS (besides the Server header) is by sending a TRACE request. If a Max-Forwards: 0 header present in the request, ATS will return an answer to TRACE requests by default without forwarding it to the backend. Microsoft IIS It seems like Microsoft IIS supports decoding chunked encoding (https://www.kitploit.com/search/label/Chunked%20Encoding) inside HTTP/2 bodies. That is strange behaviour; however, it is innocent from the security point of view. To detect you're dealing with IIS, you can send a request with a "transfer-encoding:chunked" header and an incorrect chunked body. If you see Microsoft-HTTPAPI or something like this in the Server header, that is it. Other WAFs WAFs try to detect suspicious headers - it's their job. Sometimes it results in the tools saying "distinguishable": WAF could block something like content_length:-1 and allow content_length:1 just because its filters happen to come out with these decisions. If you see a WAF in the Server header, it's probably a false positive. Contacts If you have any ideas on this topic, contact me via @emil_lerner (https://twitter.com/emil_lerner) on Twitter or @neexemil (https://t.me/neexemil) on Telegram - or post an issue here on GitHub.

Download Http2Smugl (https://github.com/neex/http2smugl)

___________________________
@hacking_Attack
@Hacking_Video