Writeups · logicbreaker

Writeups

All xss sql-injection csrf clickjacking

2026-09-17 Easy

HTTP request smuggling, basic TE.CL vulnerability

the te.cl twin of the gpost lab, where the front end reads the 5c chunk whole but the back end trusting Content-Length 4 stops early and leaves a full GPOST request line for the next request

HTTP request smuggling

HTTP request smuggling 2 min
2026-09-15 Easy

HTTP request smuggling, basic CL.TE vulnerability

the plainest cl.te desync, smuggling a single trailing G past a front end that trusts Content-Length so the next request line reads GPOST

HTTP request smuggling

HTTP request smuggling 2 min
2026-09-15 Medium

CL.0 request smuggling

cl.0 smuggling where the back end ignores Content-Length on certain endpoints

HTTP request smuggling

HTTP request smuggling 3 min
2026-09-15 Medium

HTTP/2 request splitting via CRLF injection

http/2 request splitting where injected crlf characters split one request into two complete ones after the downgrade

HTTP request smuggling

HTTP request smuggling 5 min
2026-09-15 Insane

HTTP/2 request smuggling via CRLF injection

http/2 exclusive smuggling where a carriage return and line feed hidden in a header value is harmless data over http/2 but splits into a real Transfer-Encoding header once the front end downgrades to http/1, giving a desync that captures the victim's session cookie into our own search history

HTTP request smuggling

HTTP request smuggling 9 min
2026-09-15 Medium

H2.CL request smuggling

h2.cl smuggling where the front end downgrades http/2 but keeps our injected Content-Length 0, so the back end reads our request as empty and the smuggled resources prefix redirects the victim to a malicious script

HTTP request smuggling

HTTP request smuggling 4 min
2026-09-15 Hard

Response queue poisoning via H2.TE request smuggling

h2.te smuggling where the front end downgrades http/2 and keeps our Transfer-Encoding header

HTTP request smuggling

HTTP request smuggling 7 min