HTTP Desync Attacks: Request Smuggling Reborn
summary
Remote unauthenticated HTTP desync lets an attacker make a backend treat an injected prefix as a separate request by abusing mismatched parsing of Content-Length vs Transfer-Encoding: chunked or using HTTP line wrapping. A timing‑based detection plus the released scanner smuggle probe reliably finds vulnerable chains; verified exploits include cache poisoning, mass account hijacks (Trello/Bugzilla), internal API access (New Relic), and chained CDN poisoning (PayPal), earning over $70k in bounties. Defensive fix: front-end normalization or use HTTP/2 to backends.
AI-written summary · about
chapters (26)
- 0:00Intro
- 3:56Outline
- 5:48HTTP/1.1 keep-alive, desynchronized
- 7:08Desynchronizing: the classic approach
- 8:01Desynchronizing: the chunked approach
- 8:52Desynchronizing: the TE.CL approach
- 11:59Methodology
- 12:25Detecting desync
- 15:09Confirming desync
- 17:32Bypassing rules
- 18:18Bypassing rewrites
- 19:44Request reflection
- 20:47Exploring
- 22:57Involuntary request storage
- 25:37Harmful responses
- 27:04Accidental Cache Poisoning
- 29:47Chaining DOM Problems
- 30:47Redirects with teeth
- 32:43Web Cache Poisoning
- 33:52PayPal Poisoning
- 35:28Wrapped exploits
- 40:36Aggressive detection
- 41:30Source code review
- 42:31Other sources
- 43:55Defence
- 45:57Case Study: Application Load Balancer BHEU EXCLUSIVE
related talks
50mHTTP Desync Attacks: Smashing into the Cell Next Door
45mHTTP Desync Attacks: Smashing Into The Cell Next Door
56mModern Web Vulnerabilities 2020
44mCache Me If You Can: Messing with Web Caching
55mAttacking Modern Web Technologies
48mA Weakness In Chrome & A New Hacking Technique
44mSmashing The State Machine: The True Potential Of Web Race Conditions
52mHow to get properly hacked!