How request smuggling works
Front-end and back-end disagree on where a request ends. Yours hides in between.
Most production traffic passes through two servers: a front-end (load balancer, CDN, proxy) that forwards to a back-end. Each must decide where each request ends, using Content-Length, Transfer-Encoding, or both. When they disagree, the attacker sends one body with two framings: the front-end sees one request, the back-end sees two — and the second one is invisible to every control in front of it.
The classic shapes are named for who honors what. CL.TE: front-end uses Content-Length, back-end prefers Transfer-Encoding. TE.CL: the reverse. The hidden request typically targets something unreachable directly: an admin path, a state-changing endpoint, or a poisoned prefix that corrupts the next stranger's request (cache poisoning via desync).
In this lab you get a repeater, not a shell prompt: craft raw requests and read both servers' verdicts. Send one clean POST first, then a body the two framings split differently, and watch the back-end queue a request the front-end never saw.
That was the whole lesson.
A free account adds the interactive part: the marking quiz, the lab if this lesson carries one, live progress, the timed exam, and a certificate employers can verify.