HTTP Request Smuggling | Tutorial basic

What Is HTTP Request Smuggling ? 

HTTP Request Smuggling exploits the discrepancy in parsing non-RFC-compliant HTTP requests between two HTTP devices (typically a front-end proxy or HTTP-enabled firewall and a backend server). The HTTP Request Smuggling technique is performed by sending multiple specially crafted HTTP requests that cause two attacked entities to see two different sets of requests. Request smuggling vulnerabilities are often critical in nature, allowing an attacker to bypass security controls, gain unauthorized access to sensitive data, and directly compromise other application users. (sumber:  https://www.whitehatsec.com/glossary/content/http-request-smuggling) 

   Jadi, kesimpulan yang bisa saya ambil dari penjelasan diatas, bahwa HTTP Request smuggling adalah melakukan pengiriman atau permintaan HTTP yang dibuat secara khusus oleh penyerang yang dimana dapat menyebabkan kebingungan pada sisi server.  

How to use this technique ? 

    Disini saya sudah membuat tutorial sebagian dari cara menggunakan teknik ini, tutorial yang saya buat hanyalah bersifat pembelajaran dan sangat dasar sekali. Karena pada teknik banyak sekali tata cara yang bisa di lakukan. 

How To Prevent HTTP Request Smuggling ? 

Certain IT optimizations can leave systems vulnerable to HTTP smuggling, such as the reuse of back-end server connections. Disabling reuse forces each request to be sent over a separate connection, reducing risk of HTTP desynchronization. Using HTTP/2 on back-end servers may also help mitigate unauthorized requests, as the protocol helps prevent ambiguity. Finally, many web application firewalls may help identify and block inconsistencies in HTTP request traffic, mitigating any potentially smuggled requests. Unfortunately, firewalls may also serve as a mechanism for smuggling. Detection of HTTP request smuggling attacks can be enhanced using decryption. HTTP request smuggling attacks typically occur against public facing services via HTTPs. For this reason, it's critical that security tools have decryption capabilities for all commonly encrypted industry protocols such as TLS. (Sumber : https://www.extrahop.com/resources/attacks/http-request-smuggling/)

Mungkin sekian yang bisa sedikit saya sampaikan  pada pembahasan kali ini, terima kasih. 

loading...