Lab: hide a request
Front-end reads Content-Length, back-end reads chunked. Split them.
Open the Repeater tab. The brief file states each server's framing rule. Your clean POST must carry matching framing; your smuggled one carries both headers with a body the two rules slice differently — the GPOST line is the stowaway.
Send requests with the request line, headers, a blank line, then the body. The verdict names both servers' readings: agreed means one request, desync means your hidden request queued behind it.
That was the whole lesson.
A free account adds the interactive part: the marking quiz, the lab if this lesson carries one, live progress, the timed exam, and a certificate employers can verify.