Later archive addition

HTTP Response Smuggling

Amit Klein

Extends HTTP response-splitting attacks by exploiting differences between defensive filters, proxies and browsers. Lone line-ending characters, conflicting Content-Length headers and permissive status-line parsing bypass proposed protections and enable cache poisoning. Worked examples and browser checks explain when these techniques succeed and why blocking only familiar attack strings fails.

Record

Researcher

Amit Klein

In the archive

• Added to the 2006 archive after the original list was published

Tags

• http
• smuggling
• response-splitting
• parser-differential
• header-injection
• cache-poisoning
• filter-bypass
• owasp-a03-2021
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of Amit Klein, first published at the original source. Preserved copies are kept so the citation survives its host.