Top 10 winner

Practical HTTP Header Smuggling

Daniel Thatcher

Obfuscating a header name, for example by appending characters after a space, can make a frontend proxy ignore it while the backend still parses it as the real header. The paper gives an error-comparison method for detecting this black-box, and uses it to bypass AWS API Gateway IP restrictions, poison a CloudFront cache with a smuggled Host header, and safely detect CL.CL request smuggling.

Record

Researcher

Daniel Thatcher

In the archive

• Ranked #8 in the 2021 Top 10 Web Hacking Techniques

Related sources

• Request-smuggling confirmation script
• Cache-poisoning confirmation script
• Research extension fork
• Talk recording

Tags

• request-smuggling
• header-injection
• cache-poisoning
• smuggling
• auth-bypass
• http
• reverse-proxy
• aws
• tooling
• owasp-a01-2021
• owasp-a03-2021

This page is the archive's own catalogue record. The research is the work of Daniel Thatcher, first published at the original source. Preserved copies are kept so the citation survives its host.