HTTP Request Smuggling

[Draymire]

If I am understanding This correctly than I could modify this to allow me to bypass a proxy assuming the proxy blocks by DNS and not IPs.

Code: Select all

GET /some_page.jsp?param1=value1&param2=
Content-Type: application/x-www-form-
Content-Length: 0
Foobar: GET /mypage.jsp HTTP/1.0
Cookie: my_id=1234567
Authorization: Basic ugwerwguwygruwy


Like so

Code: Select all

GET 64.32.24.200
Content-Type: application/x-www-form-
Content-Length: 0
Foobar: GET /forums HTTP/1.0
Cookie: appropriate cookies for HTS
***other headers needed***


Or assuming it checks both DNS and IP i could use this

Code: Select all

GET / HTTP/1.0
X-DecoyHost: www.google.ca
Host: www.hackthissite.org


Please correct me where I am wrong. I know it is somewhere.