Python Keep "Content-Length" from changing on URL Request?

[Python] Keep "Content-Length" from changing on URL Request? - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444)
+--- Forum: Coding (https://hackforums.net/forumdisplay.php?fid=151)
+---- Forum: Software Development (https://hackforums.net/forumdisplay.php?fid=118)
+---- Thread: [Python] Keep "Content-Length" from changing on URL Request? (/showthread.php?tid=6044929)

Keep "Content-Length" from changing on URL Request? - gurlhackerclub - Jan 28, 2020

I want to keep content-length header static, I don't want it to change.
Here is my code-

Code 
import requests

url = 'http://127.0.0.1'

headers = {

            'User-Agent': 'Mozilla/5.0 (Windows NT 6.1; WOW64; rv:32.0) Gecko/20100101 Firefox/32.0',

            'Content-Type': 'application/x-www-form-urlencoded',

            'Content-Length':'6',

            'Transfer-Encoding':'chunked'

        }

payload = {'key1':'0\r\n\r\nG'}

if __name__ == '__main__':

    print('your url '+url+'\n')

    try:

        r = requests.post(url,payload,headers=headers)

        print(r.statuscode)

        print(r.text)

    except requests.exceptions.Timeout:

        print('Time Out!\n')

    except requests.exceptions.ConnectionError:

        print('Not Connected \n')

    except requests.exceptions.ReadTimeout:

        print('read timeout\n')

    except requests.exceptions.RequestException as err:

        print(err)

    except:

        print('undetermined error')

Here is output from run. Notice content-length says 19. I want it to stay as 6.

Code 
ERROR:root:Host: 127.0.0.1

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:32.0) Gecko/20100101 Firefox/32.0

Accept-Encoding: gzip, deflate

Accept: */*

Connection: keep-alive

Content-Type: application/x-www-form-urlencoded

Content-Length: 19

Transfer-Encoding: chunked

Im case you want to know why. I am practicing http port smuggling on portswigger academy. I want to see if I can do port smuggling with python, instead of using burp suite.

Thanks

RE: Keep "Content-Length" from changing on URL Request? - Riԁdle - Jan 28, 2020

You'll have to prepare the request manually, then remove the generated content-length header:

from requests import Request, Session

Code 
s = Session()

req = Request('POST', url, data=data)

prepped = req.prepare()

del prepped.headers['content-length']

response = s.send(prepped)

Do note that most compliant HTTP servers may then ignore your post body!

If you meant to use chunked transfer encoding (where you don't have to send a content length), then use a iterator for the data parameter. See Chunked-Encoded Requests in the documentation. No Content-Length header will be set in that case.

source: https://stackoverflow.com/questions/27043402/python-requests-remove-the-content-length-header-from-post

RE: Keep "Content-Length" from changing on URL Request? - gurlhackerclub - Jan 29, 2020

(Jan 28, 2020 05:34 PM)Riԁdle Wrote: You'll have to prepare the request manually, then remove the generated content-length header:

from requests import Request, Session

Code
s = Session() req = Request('POST', url, data=data) prepped = req.prepare() del prepped.headers['content-length'] response = s.send(prepped)
Do note that most compliant HTTP servers may then ignore your post body!

If you meant to use chunked transfer encoding (where you don't have to send a content length), then use a iterator for the data parameter. See Chunked-Encoded Requests in the documentation. No Content-Length header will be set in that case.

source: https://stackoverflow.com/questions/27043402/python-requests-remove-the-content-length-header-from-post

Thanks Riddle, I appreciate your help. Yes, I have to use Chunked Encoding and Content Length in order to do HTTP smuggling. I don't know if I will find this in the wild, but fun to try.
https://portswigger.net/web-security/request-smuggling