HTTP Desync Attacks: Smashing into the Cell Next Door
summary
Remote unauthenticated attackers can break HTTP request isolation to splice a malicious prefix into another user’s request, enabling header injection, cache poisoning, account takeover and mass XSS; the presenter demonstrates chunked vs content-length and many subtle desync tricks, a timing-based detection method and a released Burp extension plus Turbo Intruder scripts, shows working exploits against real systems (PayPal $19k, Akamai $20k, Bugzilla $4k, New Relic thousands) and reports over $50k in bounties while providing practical mitigation steps.
AI-written summary · about
chapters (16)
- 0:00Introduction
- 4:31The HTTP Chain
- 6:48Desynchronisation
- 9:23Why does it work
- 11:48Detection
- 17:04Case Studies
- 17:54Smuggling
- 20:50Backend System
- 26:05Cache Poisoning
- 29:44CDNs
- 30:37DOM
- 31:43Local Feed
- 33:41PayPal
- 34:45PayPal Login
- 37:35Demo
- 42:23How to fix
related talks
45mHTTP Desync Attacks: Smashing Into The Cell Next Door
48mHTTP Desync Attacks: Request Smuggling Reborn
42mModern web application bugs
47mLive Hacking: Breaking into Your Web App
44mCache Me If You Can: Messing with Web Caching
43mAttacking Modern Web Technologies
56mModern Web Vulnerabilities 2020
55mAttacking Modern Web Technologies