[gurlhackerclub]

I want to keep content-length header static, I don't want it to change.
Here is my code-

Code

import requests
url = 'http://127.0.0.1'
headers = {
            'User-Agent': 'Mozilla/5.0 (Windows NT 6.1; WOW64; rv:32.0) Gecko/20100101 Firefox/32.0',
            'Content-Type': 'application/x-www-form-urlencoded',
            'Content-Length':'6',
            'Transfer-Encoding':'chunked'
        }
payload = {'key1':'0\r\n\r\nG'}
if __name__ == '__main__':
    print('your url '+url+'\n')
    try:

        r = requests.post(url,payload,headers=headers)
        print(r.statuscode)
        print(r.text)
    except requests.exceptions.Timeout:
        print('Time Out!\n')
    except requests.exceptions.ConnectionError:
        print('Not Connected \n')
    except requests.exceptions.ReadTimeout:
        print('read timeout\n')
    except requests.exceptions.RequestException as err:
        print(err)
    except:
        print('undetermined error')

Here is output from run. Notice content-length says 19. I want it to stay as 6.

Code

ERROR:root:Host: 127.0.0.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:32.0) Gecko/20100101 Firefox/32.0
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 19
Transfer-Encoding: chunked

Im case you want to know why. I am practicing http port smuggling on portswigger academy. I want to see if I can do port smuggling with python, instead of using burp suite.

Thanks

[Riԁdle]

You'll have to prepare the request manually, then remove the generated content-length header:

from requests import Request, Session

Code

s = Session()
req = Request('POST', url, data=data)
prepped = req.prepare()
del prepped.headers['content-length']
response = s.send(prepped)

Do note that most compliant HTTP servers may then ignore your post body!

If you meant to use chunked transfer encoding (where you don't have to send a content length), then use a iterator for the data parameter. See Chunked-Encoded Requests in the documentation. No Content-Length header will be set in that case.

source: https://stackoverflow.com/questions/2704...-from-post

[gurlhackerclub]

You'll have to prepare the request manually, then remove the generated content-length header:

from requests import Request, Session

Code

s = Session()
req = Request('POST', url, data=data)
prepped = req.prepare()
del prepped.headers['content-length']
response = s.send(prepped)

Do note that most compliant HTTP servers may then ignore your post body!

If you meant to use chunked transfer encoding (where you don't have to send a content length), then use a iterator for the data parameter. See Chunked-Encoded Requests in the documentation. No Content-Length header will be set in that case.

source: https://stackoverflow.com/questions/2704...-from-post

Thanks Riddle, I appreciate your help. Yes, I have to use Chunked Encoding and Content Length in order to do HTTP smuggling. I don't know if I will find this in the wild, but fun to try.
https://portswigger.net/web-security/request-smuggling