① Send Request attacker view
This is the raw TCP request sent straight to the front-end proxy at
127.0.0.1:8080 — exactly like curl or Burp
Repeater would send it. Load a preset, inspect it, then send it.
Response received back from the front-end (this is what the attacker's own connection sees):
(no request sent yet)
③ Victim Session next visitor
A different, innocent user opens a brand-new connection to the front-end and asks for their own account page — nothing attacker- controlled in this request. If the shared front-end↔back-end connection is desynced, they may get a response meant for someone else.
② Requests Log what the backend actually received
Every logical HTTP request the single back-end app instance parsed off its one shared connection from the front-end, in order. Watch for a request that nobody's own connection actually sent on its own — that is the smuggled request hiding inside someone else's body.
| # | time | method | path | headers | body preview |
|---|