Writeups · logicbreaker

Writeups

All xss sql-injection csrf clickjacking

2026-09-17 Hard

Exploiting HTTP request smuggling to perform web cache poisoning

request smuggling turned into web cache poisoning, smuggling a next post redirect with our exploit server as the Host so it gets cached under tracking.js, and timing it against the Age header

HTTP request smuggling

HTTP request smuggling 7 min
2026-09-17 Easy

HTTP request smuggling, obfuscating the TE header

te.cl desync between two servers that both support chunked, forced by sending Transfer-Encoding twice

HTTP request smuggling

HTTP request smuggling 2 min
2026-09-17 Easy

HTTP request smuggling, basic TE.CL vulnerability

the te.cl twin of the gpost lab, where the front end reads the 5c chunk whole but the back end trusting Content-Length 4 stops early and leaves a full GPOST request line for the next request

HTTP request smuggling

HTTP request smuggling 2 min
2026-09-15 Easy

HTTP request smuggling, basic CL.TE vulnerability

the plainest cl.te desync, smuggling a single trailing G past a front end that trusts Content-Length so the next request line reads GPOST

HTTP request smuggling

HTTP request smuggling 2 min
2026-09-15 Medium

CL.0 request smuggling

cl.0 smuggling where the back end ignores Content-Length on certain endpoints

HTTP request smuggling

HTTP request smuggling 3 min
2026-09-15 Medium

HTTP/2 request splitting via CRLF injection

http/2 request splitting where injected crlf characters split one request into two complete ones after the downgrade

HTTP request smuggling

HTTP request smuggling 5 min
2026-09-15 Insane

HTTP/2 request smuggling via CRLF injection

http/2 exclusive smuggling where a carriage return and line feed hidden in a header value is harmless data over http/2 but splits into a real Transfer-Encoding header once the front end downgrades to http/1, giving a desync that captures the victim's session cookie into our own search history

HTTP request smuggling

HTTP request smuggling 9 min