Skip to content

Commit 7c092c7

Browse files
RavenTaitpatel-bhavin
RavenTait
and
patel-bhavin
authored
HTTP Request Smuggling (#3731)
* HTTP Request Smuggling * Updates from PR comments --------- Co-authored-by: Bhavin Patel <[email protected]>
1 parent 66aa9e9 commit 7c092c7

8 files changed

+501
-0
lines changed

‎detections/web/http_duplicated_header.yml‎

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
name: HTTP Duplicated Header
2+
id: 1606cc5b-fd5f-4865-9fe3-0ed1eaec2df6
3+
version: 1
4+
date: '2025-10-15'
5+
author: Raven Tait, Splunk
6+
status: production
7+
type: Anomaly
8+
description: Detects when a request has more than one of the same header. This is commonly used
9+
in request smuggling and other web based attacks. HTTP Request Smuggling exploits inconsistencies in how front-end
10+
and back-end servers parse HTTP requests by using ambiguous or malformed headers to hide malicious
11+
requests within legitimate ones. Attackers leverage duplicate headers, particularly Content-Length
12+
and Transfer-Encoding, to cause different servers in the chain to disagree on where one request
13+
ends and another begins. RFC7230 states that a sender MUST NOT generate multiple header fields with the same field
14+
name in a message unless either the entire field value for that header field is defined as a comma-separated
15+
list or the header field is a well-known exception.
16+
data_source:
17+
- Suricata
18+
search: '`suricata` http.request_headers{}.name="*"
19+
| rename dest_ip as dest
20+
| spath path=http.request_headers{}.name output=header_names
21+
| mvexpand header_names
22+
| where lower(header_names) != "set-cookie"
23+
| stats count by _raw, header_names, src_ip, dest
24+
| where count > 1
25+
| stats values(header_names) as duplicate_headers by _raw, count, src_ip, dest
26+
| `http_duplicated_header_filter`'
27+
how_to_implement: This detection requires the Web datamodel
28+
to be populated from a supported Technology Add-On like Suricata, Splunk for Apache,
29+
Splunk for Nginx, or Splunk for Palo Alto. Some of these will need to have all headers
30+
dumped to contain the necessary fields.
31+
known_false_positives: False positives are not expected, however, monitor, filter,
32+
and tune as needed based on organization log sources.
33+
references:
34+
- https://portswigger.net/web-security/request-smuggling#what-is-http-request-smuggling
35+
- https://portswigger.net/research/http1-must-die
36+
- https://www.vaadata.com/blog/what-is-http-request-smuggling-exploitations-and-security-best-practices/
37+
- https://www.securityweek.com/new-http-request-smuggling-attacks-impacted-cdns-major-orgs-millions-of-websites/
38+
drilldown_searches:
39+
- name: View the detection results for - "$dest$"
40+
search: '%original_detection_search% | search dest = "$dest$"'
41+
earliest_offset: $info_min_time$
42+
latest_offset: $info_max_time$
43+
- name: View risk events for the last 7 days for - "$dest$"
44+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
45+
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
46+
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
47+
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
48+
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
49+
| `security_content_ctime(lastTime)`'
50+
earliest_offset: $info_min_time$
51+
latest_offset: $info_max_time$
52+
rba:
53+
message: Duplicated headers within a web request was detected.
54+
The source IP is $src_ip$ and the destination is $dest$.
55+
risk_objects:
56+
- field: dest
57+
type: system
58+
score: 51
59+
threat_objects:
60+
- field: src_ip
61+
type: ip_address
62+
tags:
63+
analytic_story:
64+
- HTTP Request Smuggling
65+
asset_type: Network
66+
mitre_attack_id:
67+
- T1071.001
68+
- T1190
69+
product:
70+
- Splunk Enterprise
71+
- Splunk Enterprise Security
72+
- Splunk Cloud
73+
security_domain: network
74+
tests:
75+
- name: True Positive Test
76+
attack_data:
77+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/request_smuggling/suricata_request_smuggling.log
78+
sourcetype: suricata
79+
source: suricata

‎detections/web/http_possible_request_smuggling.yml‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
name: HTTP Possible Request Smuggling
2+
id: 97d85f98-9d15-41a0-8682-7030454875e7
3+
version: 1
4+
date: '2025-10-06'
5+
author: Raven Tait, Splunk
6+
status: production
7+
type: TTP
8+
description: HTTP request smuggling is a technique for interfering with the way a web site processes sequences
9+
of HTTP requests that are received from one or more users. Request smuggling vulnerabilities are often
10+
critical in nature, allowing an attacker to bypass security controls, gain unauthorized access to
11+
sensitive data, and directly compromise other application users. This detection identifies a common request
12+
smuggling technique of using both Content-Length and Transfer-Encoding headers to cause a parsing confusion
13+
between the frontend and backend.
14+
data_source:
15+
- Suricata
16+
search: '`suricata` (http.request_headers{}.name="*Content-Length*" http.request_headers{}.name="*Transfer-Encoding*")
17+
OR (http.request_headers{}.name="*Content-Length*" http.request_headers{}.value="*Transfer-Encoding*")
18+
OR (http.request_headers{}.value="*Content-Length*" http.request_headers{}.name="*Transfer-Encoding*")
19+
OR (http.request_headers{}.name="*Content-Length*" http.request_headers{}.value="0")
20+
| rename dest_ip as dest
21+
| rex field=_raw "request_headers.:\[(?<headers>.*)\]"
22+
| stats count min(_time) as firstTime max(_time) as lastTime by dest, dest_port, src_ip, http.url,
23+
http.http_method, http.http_user_agent, http.protocol, http.status, headers
24+
| `security_content_ctime(firstTime)`
25+
| `security_content_ctime(lastTime)`
26+
| `http_possible_request_smuggling_filter`'
27+
how_to_implement: This detection requires the Web datamodel
28+
to be populated from a supported Technology Add-On like Suricata, Splunk for Apache,
29+
Splunk for Nginx, or Splunk for Palo Alto. Some of these will need to have all headers
30+
dumped to contain the necessary fields.
31+
known_false_positives: False positives are not expected, however, monitor, filter,
32+
and tune as needed based on organization log sources.
33+
references:
34+
- https://portswigger.net/web-security/request-smuggling#what-is-http-request-smuggling
35+
- https://portswigger.net/research/http1-must-die
36+
- https://www.vaadata.com/blog/what-is-http-request-smuggling-exploitations-and-security-best-practices/
37+
- https://www.securityweek.com/new-http-request-smuggling-attacks-impacted-cdns-major-orgs-millions-of-websites/
38+
drilldown_searches:
39+
- name: View the detection results for - "$dest$"
40+
search: '%original_detection_search% | search dest = "$dest$"'
41+
earliest_offset: $info_min_time$
42+
latest_offset: $info_max_time$
43+
- name: View risk events for the last 7 days for - "$dest$"
44+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
45+
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
46+
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
47+
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
48+
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
49+
| `security_content_ctime(lastTime)`'
50+
earliest_offset: $info_min_time$
51+
latest_offset: $info_max_time$
52+
rba:
53+
message: Possible request smuggling against a web request was detected.
54+
The source IP is $src_ip$ and the destination is $dest$.
55+
risk_objects:
56+
- field: dest
57+
type: system
58+
score: 60
59+
threat_objects:
60+
- field: src_ip
61+
type: ip_address
62+
tags:
63+
analytic_story:
64+
- HTTP Request Smuggling
65+
asset_type: Network
66+
mitre_attack_id:
67+
- T1071.001
68+
product:
69+
- Splunk Enterprise
70+
- Splunk Enterprise Security
71+
- Splunk Cloud
72+
security_domain: network
73+
tests:
74+
- name: True Positive Test
75+
attack_data:
76+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/request_smuggling/suricata_request_smuggling.log
77+
sourcetype: suricata
78+
source: suricata

‎detections/web/http_rapid_post_with_mixed_status_codes.yml‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
name: HTTP Rapid POST with Mixed Status Codes
2+
id: c8c987d6-3a1a-4555-9a52-eea0741b6113
3+
version: 1
4+
date: '2025-10-14'
5+
author: Raven Tait, Splunk
6+
status: production
7+
type: Anomaly
8+
description: This detection identifies rapid-fire POST request attacks where an attacker
9+
sends more than 20 POST requests within a 5-second window, potentially attempting to
10+
exploit race conditions or overwhelm request handling. The pattern is particularly
11+
suspicious when responses vary in size or status codes, indicating successful
12+
exploitation attempts or probing for vulnerable endpoints.
13+
data_source:
14+
- Nginx Access
15+
search: '`nginx_access_logs` http_method="POST"| bin _time span=5s
16+
| rename dest_ip as dest
17+
| stats count, values(status) as status_codes, values(bytes_out) as bytes_out, values(uri_path) as uris by _time, src_ip, dest, http_user_agent
18+
| where count>20
19+
| table _time, dest, src_ip, count, status_codes, bytes_out, http_user_agent
20+
| `http_rapid_post_with_mixed_status_codes_filter`'
21+
how_to_implement: This analytic necessitates the collection of web data, which can
22+
be achieved through Splunk Stream or by utilizing the Splunk Add-on for Apache Web
23+
Server. No additional configuration is required for this analytic.
24+
known_false_positives: False positives may be present if the activity is part of diagnostics
25+
or testing. Filter as needed.
26+
references:
27+
- https://portswigger.net/web-security/request-smuggling#what-is-http-request-smuggling
28+
- https://portswigger.net/research/http1-must-die
29+
- https://www.vaadata.com/blog/what-is-http-request-smuggling-exploitations-and-security-best-practices/
30+
- https://www.securityweek.com/new-http-request-smuggling-attacks-impacted-cdns-major-orgs-millions-of-websites/
31+
drilldown_searches:
32+
- name: View the detection results for - "$dest$"
33+
search: '%original_detection_search% | search dest = "$dest$"'
34+
earliest_offset: $info_min_time$
35+
latest_offset: $info_max_time$
36+
- name: View risk events for the last 7 days for - "$dest$"
37+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
38+
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
39+
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
40+
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
41+
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
42+
| `security_content_ctime(lastTime)`'
43+
earliest_offset: $info_min_time$
44+
latest_offset: $info_max_time$
45+
rba:
46+
message: A potential attempt to perform request smuggling against a web server was detected.
47+
The source IP is $src_ip$ and the destination is $dest$.
48+
risk_objects:
49+
- field: dest
50+
type: system
51+
score: 40
52+
threat_objects:
53+
- field: src_ip
54+
type: ip_address
55+
tags:
56+
analytic_story:
57+
- HTTP Request Smuggling
58+
asset_type: Web Server
59+
mitre_attack_id:
60+
- T1071.001
61+
- T1190
62+
- T1595
63+
product:
64+
- Splunk Enterprise
65+
- Splunk Enterprise Security
66+
- Splunk Cloud
67+
security_domain: network
68+
tests:
69+
- name: True Positive Test
70+
attack_data:
71+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/request_smuggling/nginx_request_smuggling.log
72+
source: nginx:plus:kv
73+
sourcetype: nginx:plus:kv

‎detections/web/http_request_to_reserved_name_on_iis_server.yml‎

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
name: HTTP Request to Reserved Name on IIS Server
2+
id: 1e45e6a8-110b-4886-b815-8d69cf35bf0a
3+
version: 1
4+
date: '2025-10-17'
5+
author: Raven Tait, Splunk
6+
status: production
7+
type: TTP
8+
description: Detects attempts to exploit a request smuggling technique against IIS that leverages
9+
a Windows quirk where requests for reserved Windows device names such as "/con" trigger an early
10+
server response before the request body is received. When combined with a Content-Length desynchronization,
11+
this behavior can lead to a parsing confusion between frontend and backend.
12+
data_source:
13+
- Suricata
14+
search: '| tstats count min(_time) as firstTime max(_time) as lastTime from datamodel=Web
15+
where Web.url IN ("/con", "/prn", "/aux", "/nul", "/com1","/com2","/com3","/com4",
16+
"/com5","/com6","/com7") by Web.src, Web.dest, Web.http_user_agent, Web.url, Web.status,
17+
Web.http_method
18+
| `drop_dm_object_name("Web")`
19+
| `security_content_ctime(firstTime)`
20+
| `security_content_ctime(lastTime)`
21+
| `http_request_to_reserved_name_on_iis_server_filter`'
22+
how_to_implement: To implement this analytic, ensure proper logging is occurring with
23+
IIS, Apache, or a Proxy server and that these logs are being ingested into Splunk.
24+
The analytic was written against Suricata. The proper TA will need to be enabled
25+
and should be mapped to CIM and the Web datamodel. Ingestion of the data source
26+
is required to utilize this detection. In addition, if it is not mapped to the datamodel,
27+
modify the query for your application logs to look for requests the same URI and
28+
investigate further.
29+
known_false_positives: False positives are not expected on IIS servers, as the detection is based
30+
on the presence of web requests to reserved names, which is not a common
31+
page to be accessed by legitimate users. Modify the query as needed to
32+
reduce false positives or hunt for additional indicators of compromise.
33+
references:
34+
- https://portswigger.net/web-security/request-smuggling#what-is-http-request-smuggling
35+
- https://portswigger.net/research/http1-must-die
36+
- https://www.vaadata.com/blog/what-is-http-request-smuggling-exploitations-and-security-best-practices/
37+
- https://www.securityweek.com/new-http-request-smuggling-attacks-impacted-cdns-major-orgs-millions-of-websites/
38+
drilldown_searches:
39+
- name: View the detection results for - "$dest$"
40+
search: '%original_detection_search% | search dest = "$dest$"'
41+
earliest_offset: $info_min_time$
42+
latest_offset: $info_max_time$
43+
- name: View risk events for the last 7 days for - "$dest$"
44+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
45+
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
46+
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
47+
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
48+
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
49+
| `security_content_ctime(lastTime)`'
50+
earliest_offset: $info_min_time$
51+
latest_offset: $info_max_time$
52+
rba:
53+
message: Known scripting tool was used against a web request.
54+
The source IP is $src$ and the destination is $dest$.
55+
risk_objects:
56+
- field: dest
57+
type: system
58+
score: 31
59+
threat_objects:
60+
- field: src
61+
type: ip_address
62+
tags:
63+
analytic_story:
64+
- HTTP Request Smuggling
65+
asset_type: Network
66+
mitre_attack_id:
67+
- T1071.001
68+
- T1190
69+
product:
70+
- Splunk Enterprise
71+
- Splunk Enterprise Security
72+
- Splunk Cloud
73+
security_domain: network
74+
tests:
75+
- name: True Positive Test
76+
attack_data:
77+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/request_smuggling/suricata_reserved_names.log
78+
sourcetype: suricata
79+
source: suricata

‎detections/web/http_suspicious_tool_user_agent.yml‎

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
name: HTTP Suspicious Tool User Agent
2+
id: 1ca76190-4997-4d19-b5bc-9e220b70c7d3
3+
version: 1
4+
date: '2025-10-09'
5+
author: Raven Tait, Splunk
6+
status: production
7+
type: Anomaly
8+
description: This Splunk query analyzes web access logs to identify and categorize
9+
non-browser user agents, detecting various types of security tools, scripting languages,
10+
automation frameworks, and suspicious patterns. This activity can signify malicious actors
11+
attempting to interact with web endpoints in non-standard ways.
12+
data_source:
13+
- Nginx Access
14+
search: '`nginx_access_logs`
15+
| eval http_user_agent = lower(http_user_agent)
16+
| `security_content_ctime(firstTime)`
17+
| `security_content_ctime(lastTime)`
18+
| `drop_dm_object_name(Web)`
19+
| lookup scripting_tools_user_agents tool_user_agent AS http_user_agent OUTPUT tool
20+
| where isnotnull(tool)
21+
| rename dest_ip as dest
22+
| stats count min(firstTime) as first_seen max(lastTime) as last_seen values(tool) as tool
23+
by http_user_agent dest src_ip status
24+
| `http_suspicious_tool_user_agent_filter`'
25+
how_to_implement: This analytic necessitates the collection of web data, which can
26+
be achieved through Splunk Stream or by utilizing the Splunk Add-on for Apache Web
27+
Server. No additional configuration is required for this analytic.
28+
known_false_positives: False positives may be present if the activity is part of diagnostics
29+
or testing. Filter as needed.
30+
references:
31+
- https://portswigger.net/web-security/request-smuggling#what-is-http-request-smuggling
32+
- https://portswigger.net/research/http1-must-die
33+
- https://www.vaadata.com/blog/what-is-http-request-smuggling-exploitations-and-security-best-practices/
34+
- https://www.securityweek.com/new-http-request-smuggling-attacks-impacted-cdns-major-orgs-millions-of-websites/
35+
- https://github.com/SigmaHQ/sigma/blob/master/rules/web/proxy_generic/proxy_ua_hacktool.yml
36+
- https://help.aikido.dev/zen-firewall/miscellaneous/bot-protection-details
37+
drilldown_searches:
38+
- name: View the detection results for - "$dest$"
39+
search: '%original_detection_search% | search dest = "$dest$"'
40+
earliest_offset: $info_min_time$
41+
latest_offset: $info_max_time$
42+
- name: View risk events for the last 7 days for - "$dest$"
43+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
44+
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
45+
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
46+
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
47+
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
48+
| `security_content_ctime(lastTime)`'
49+
earliest_offset: $info_min_time$
50+
latest_offset: $info_max_time$
51+
rba:
52+
message: Known scripting tool was used against a web request.
53+
The source IP is $src_ip$ and the destination is $dest$.
54+
risk_objects:
55+
- field: dest
56+
type: system
57+
score: 31
58+
threat_objects:
59+
- field: src_ip
60+
type: ip_address
61+
tags:
62+
analytic_story:
63+
- HTTP Request Smuggling
64+
asset_type: Network
65+
mitre_attack_id:
66+
- T1071.001
67+
product:
68+
- Splunk Enterprise
69+
- Splunk Enterprise Security
70+
- Splunk Cloud
71+
security_domain: network
72+
tests:
73+
- name: True Positive Test
74+
attack_data:
75+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/request_smuggling/nginx_scripting_tools.log
76+
source: nginx:plus:kv
77+
sourcetype: nginx:plus:kv

0 commit comments

Comments
 (0)