HTTP Desync Attacks: Smashing Into The Cell Next Door
summary
Demonstrates concrete HTTP request smuggling techniques that desynchronize front-end and back-end parsers by mixing Content-Length and chunked framing and by hiding headers (whitespace before colon, line-wrapped headers, LF‑only endings), releases an open‑source smuggling tool plus Burp and Turbo Intruder workflows, and shows real impact: cache poisoning, account takeover and script hijack across CDNs (Akamai, CloudFlare), an F5 Big‑IP advisory, and multiple bounties including ~$19k, $20k and $8k (≈$75k total); provides labs and practical detection tips (use netcat/openssl not curl).
AI-written summary · about
chapters (9)
- 0:00Start
- 7:34Chunked Encoding
- 11:53Bypassing Web Application Firewalls Using Malformed Headers
- 19:17Bypassing Security Rules
- 21:27Application Specific Headers
- 31:01Web Cache Deception
- 34:38Paypal
- 37:37I Could Once Again Point Poison Paypal's Login Page and They Paid Me another 20k Bounty I Thought that Was Really Generous Especially Given It Was Kind of My Fault That I Didn't Find Bypass in the First Place Okay So Now We'Ve Seen a Whole Range of Different Attacks We Can Do with Requests Smuggling I'M GonNa Attempt a Live Demo So Let's See Here Yep Something Great I'Ve Got a Replica a Replica of a Real System That May Be Familiar Generally Holds Lots of Gc Firefox
- 43:49So We'Ve Released a Bunch of Free Online Labs That You Can Use To Practice these Vulnerabilities on Real Issue Websites and Gain Experience with this for Yourself before You Go Out into the Real World and Everything Gets Really Chaotic Now the Three Key Things To Take Away Are the Http Requests Muggin Is Real Regardless of How Much You Might Not Want To Think about It Http 1 1 Parsing Is a Security Critical Function for Functionality So When You'Re Making Your Choice of Web Server this Is Something You Should Definitely Be Factoring in and Detection of Request Smuggling
related talks
50mHTTP Desync Attacks: Smashing into the Cell Next Door
48mHTTP Desync Attacks: Request Smuggling Reborn
44mCache Me If You Can: Messing with Web Caching
47mLive Hacking: Breaking into Your Web App
42mModern web application bugs
43mAttacking Modern Web Technologies
48mA Weakness In Chrome & A New Hacking Technique
42mHack Me If You Can