Ready to steal some treasures from Scrooge McDuck's Money Bin?

Read carefully this site and finish the tutorial to undertand this vulnerability. This kind of attack is very tricky to understand, but totally awesome when you finally see it in action.

If you still feel lost you can peek into the SOLUTION.md file in each of the labs - if you find another path to the flag send me a Pull Request and tell the world how you achieved it.

To get the labs done you will require at least these things:

• Docker and Docker-Compose
• A tool to intercept traffic like: Burp, Hetty or OWASP ZAP
• Your favorite Browser with debugging tools
• Terminal to run curl, netcat etc.
• An IDE with support for the language you like (Spoiler: I used bash and python. Go and Java should work as well)

The stuff in this repository is meant to be run only as CTF challenge. Do not use in production - use it in an isolated sandbox only. I'm not responsible for any damage caused by this code

• First at all: The technique behind HTTP request smuggling
• Stop using a Proxy as alternative to a Firewall and/or WAF - use it as an additional perimeter
• Don't trust your network blindly! Zero-Trust is hard to achieve but worth to iterate at it as an inspiration

Have fun and keep smuggling