Lab: HTTP/2 request splitting via CRLF injection

[@netletic]

Hey everyone! Check out this playlist for all my solutions to the HTTP Request Smuggling labs from PortSwigger - 👀 kzbin.info/aero/PLGb2cDlBWRUX1_7RAIjRkZDYgAB3VbUSw Here are the timestamps for this video - ⏱ 00:00 - Intro 00:25 - Confirm the HTTP/2 to HTTP/1.1 CRLF injection vulnerability 03:35 - Start poisoning the response queue to leak the admin's session cookie

[@zinjacoder]

Your HTTP request smuggling videos contains, by far the best explanation on the topic. Thank you for making this.

[@panchakosha]

Nice Jarno! At this rate you're going to cover all the academy's request smuggling labs. 😂

[@netletic]

Haha, thanks @panchakosha! There were definitely more request smuggling labs than I had anticipated before I started the series haha, I'm still having fun, at the same time I'm looking forward to starting videos on a new topic once this one is done and dusted. 😂

[@haireeizzam6349]

Hi Jarno, nice demonstration of this one, i still don't get a few things: 1. If this response splitting is based on response queue poisoning, why is the first request at :path /"arbitrarytexthere" being send as the response for the next request? I thought this is a normal request being made? The response queue poisoning lab request 404 response only triggers with the first smuggled GET request? 2. Why do we need to specify the second GET request with arbitrary text only then it would redirect us to the administrators page? Why this one did not get triggered if we put the /admin path as the second GET request? Your help is kindly appreciated. You're my savior 😂

[@nguyenthanhcong92]

Super!! but below are not correct yeah Timestamps: 00:00 - Intro 00:25 - Confirm the H2.TE CRLF injection vulnerability 05:00 - Explore the Search endpoint 06:29 - Smuggle the Search Request 08:12 - Capture our victim's request

[@netletic]

thanks for flagging that @nguyenthanhcong92! I've corrected the timestamps 👍

[@nguyenthanhcong92]

@@netletic really really appreciated your explanation. can you finish the XSS labs please 😍

[@yoldoshali8398]

🔥🔥🔥🔥🔥🔥

[@Safvanviber-xm3pn]

Thanks sir you save my laptop display 🥲🔥🔥

[@netletic]

thanks @Safvanviber-xm3pn, glad I made a contribution in saving your display 😂