Other nomination

HTTP Desync Attacks: Request Smuggling Reborn

James Kettle · PortSwigger Research · 7 August 2019

Revives HTTP request smuggling by making front-end and back-end servers disagree about where a request ends, using conflicting Content-Length and Transfer-Encoding headers hidden by parser quirks. Timing-based detection makes testing safe, and the poisoned socket lets an attacker prepend content to other users' requests, steal credentials, poison caches and reach internal endpoints.

Record

Researcher

James Kettle

Published by

PortSwigger Research

Date

7 August 2019

In the archive

• Nominated for the 2019 Top 10 Web Hacking Techniques

Related sources

• Presentation slides
• Research extension
• Accompanying practice labs
• Research follow-up
• Tooling follow-up
• Talk recording
• Talk recording

Tags

• request-smuggling
• desync
• http
• reverse-proxy
• cdn
• cache-poisoning
• proxy
• bug-bounty

This page is the archive's own catalogue record. The research is the work of James Kettle, first published at the original source. Preserved copies are kept so the citation survives its host.