Two servers, one disagreement

The front-end guards the door

This target is served by a front-end proxy on port 8082 that forwards to a hidden back-end. The front-end enforces one rule: outsiders may not reach /admin.

curl -s http://127.0.0.1:8082/admin

In the terminal

student@vulntech:~$ curl -s http://127.0.0.1:8082/admin
Blocked by the front-end proxy

Blocked. A normal request goes straight through, though:

curl -s http://127.0.0.1:8082/

In the terminal

student@vulntech:~$ curl -s http://127.0.0.1:8082/
Backend home. Nothing to see.

The weakness is in how the two servers find the end of a request. A request can carry both a Content-Length and a Transfer-Encoding: chunked header — and here the front-end trusts Content-Length while the back-end trusts Transfer-Encoding. When they disagree, part of your request to one server becomes a separate request to the other.