Exploiting HTTP request smuggling to capture other users' requests (Video solution, Audio)

[@jmcsmtp]

Thank you very much for this video walkthrough. For anyone struggling with this lab, note that the content-length for the smuggled request may change from what others report. It is important to adjust for your own tests.

[@georgpauwen5944]

For anyone struggling with this, I had to set the content length to 835 in order to get the full length of the token. Anything shorter wold result in a truncated, incomplete token.

[@JuanBotes]

thanks for sharing the content and talking through the lab appreciated \o/

[@rastislonge6370]

For me when I send a Content-Length of 881 it returns everything except the session token and when I try to make it any longer then it's considered too long and times out...

[@naifal-anazi4525]

How can you know the Content-length number ?

[@halfluke]

you can't, you have to guess, start from a value and increment until you capture the full victim cookie. This lab is pretty hard but in this case this video solution really helps

[@rajanrawal6396]

@@halfluke there is update length options, it will atomatically update content length..

[@halfluke]

@@rajanrawal6396 nope, we are talking about the smuggled request, which appears in the body of the first POST / request. Here the content-length header is not updated and you have to find out a satisfying number yourself

[@rajanrawal6396]

@@halfluke thanks dude. i see

[@CyberBionicX]

Thanks for the solution but my bad luck. last 3 days I'm trying and stuck on same error ""Invalid CSRF token (session does not contain a CSRF token)"" . ah Solved it.

[@GuiltySpark]

This one will not solve it can't possibly work this way or at least the lab needs more work to make this smoother

[@christopherortiz4971]

Thank you very much.

[@pranshushakya2106]

it's not solving