Top 10 winner

Browser-Powered Desync Attacks: A New Frontier in HTTP Request Smuggling

James Kettle · PortSwigger Research · 10 August 2022

A browser-issuable POST whose Content-Length the server ignores lets an attacker page desync the victim browser's own connection pool and prepend an arbitrary request, so request smuggling reaches single-server sites and intranets with no front-end. A second trigger, pause-based desync, exploits request timeouts in Varnish and Apache that leave half-read requests on a reusable connection.

Record

Researcher

James Kettle

Published by

PortSwigger Research

Date

10 August 2022

In the archive

• Ranked #2 in the 2022 Top 10 Web Hacking Techniques

Related sources

• Presentation slides
• Research extension
• Research implementation
• Talk recording
• Talk recording

Tags

• desync
• request-smuggling
• http
• cache-poisoning
• reverse-proxy
• cdn
• tooling

This page is the archive's own catalogue record. The research is the work of James Kettle, first published at the original source. Preserved copies are kept so the citation survives its host.