Writeups · logicbreaker

Writeups

All xss sql-injection csrf clickjacking

2026-09-15 Hard

Exploiting HTTP request smuggling to deliver reflected XSS

request smuggling as a delivery vehicle for reflected xss, smuggling a request whose malicious User-Agent poisons the response queue so the next visitor's browser runs

HTTP request smuggling

HTTP request smuggling 4 min
2026-09-15 Medium

Exploiting HTTP request smuggling to capture other users requests

request smuggling that steals a live victim's session, smuggling a comment post whose oversized Content-Length swallows the next user's whole request into the stored comment

HTTP request smuggling

HTTP request smuggling 3 min
2026-09-15 Medium

Exploiting HTTP request smuggling to reveal front-end request rewriting

request smuggling used to spy on the front end, capturing the next request in its rewritten form

HTTP request smuggling

HTTP request smuggling 4 min
2026-09-15 Easy

Exploiting HTTP request smuggling to bypass front-end security controls, TE.CL vulnerability

te.cl smuggling that routes past a front end block on /admin by hiding the request inside a chunk the front end reads whole

HTTP request smuggling

HTTP request smuggling 4 min
2026-09-14 Medium

Exploiting HTTP request smuggling to bypass front-end security controls, CL.TE vulnerability

cl.te smuggling that walks past a front end block on /admin, working through the local users rejection and the duplicate host error until a content length on the smuggled request swallows the next one and leaves a single Host localhost to delete carlos account

HTTP request smuggling

HTTP request smuggling 5 min
2026-09-14 Easy

HTTP request smuggling, confirming a TE.CL vulnerability via differential responses

te.cl request smuggling, the reverse of cl.te, where the front end reads the 5e chunk as one block while the back end trusting Content-Length 4 stops early and treats the leftover POST /404 as the next request

HTTP request smuggling

HTTP request smuggling 4 min
2026-09-14 Easy

HTTP request smuggling, confirming a CL.TE vulnerability via differential responses

request smuggling where the front end measures the body by Content-Length and the back end by Transfer-Encoding, so a zero chunk ends the request early and leaves a smuggled GET /404 that makes the next request come back 404

HTTP request smuggling

HTTP request smuggling 5 min