HTTP Request Smuggling: CL.TE, TE.CL & H2 Downgrade | WAF Bypass, Credential Capture & Proxy Chain Exploitation
HTTP request smuggling arises from RFC 7230 ambiguity: when a proxy and backend disagree on where one request ends and the next begins, attacker-controlled bytes prepend to a victim’s request. CL.TE embeds a hidden TE chunk; TE.CL sets a short Content-Length; H2 downgrade reintroduces CL.TE on H1 backend connections after H2 header stripping. In production proxy chains with persistent connections and traffic volume, a single smuggle primitive becomes a credential harvester. Full byte-level mechanics, Burp Suite detection methodology, and mitigation per proxy tier.
