HTTP splitting is the fact of splitting responses or requests into HTTP (most often responses). You have several ways to do this. Some applications will forget to prohibit end of lines in host names used in custom HTTP forwarding (30x), for example, or in past browsers, you could trick splitting requests when using end of lines in Digest HTTP DNS authentication names.
If you have such a problem (application flaws), you can create attacks that launch the end user (for example, using XSS), forcing users to request a URL, using separation to inject content in the first response and discard the normal response as an additional answer. This means that you can split the request, but also add the response content from the URL, which is a very specific combination, the URL can carry the whole attack.
But the separation can also be performed without application errors, using directly the flaw in the protocol analysis using an HTTP server (for example, double Content-Length headers). URL does not tolerate attack. Here splitting is a fact (one request or response splits after an attack), but does not have a direct effect. This is a tool.
HTTP smuggling is a more global thing that uses HTTP sharing, but not only. Without the lack of an application, in order to carry out a full smuggling attack (leading to cache poisoning or bypassing security filters), you also need transmitters, web agents such as proxies that carry the splitting attack, and targets (such as caches) that are affected split.
This post may interest you more .
source share