PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

How to join the desync endgame: Practical tips from pentester Tom Stacey

portswigger.net | blog | #bug-bounty | #http-desync | #request-smuggling | #http1-must-die | #cdn | #guest-post
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Guest post by pentester Tom Stacey (@t0xodile) reviewing the HTTP/1.1 Must Die research, its two new desync vulnerability classes, and practical guidance for joining the desync endgame.
Published
Collected

Related coverage

blog · portswigger.net
HTTP/1.1 Must Die: What This Means for In-House Pentesters
Why in-house pentesters should revisit request smuggling: mitigations have made desync flaws harder to spot, and Burp Suite tools can help detect and eliminate upstream HTTP/1.1.
blog · portswigger.net
HTTP/1.1 Must Die: What This Means for Bug Bounty Hunters
For bug bounty hunters, HTTP/1.1 Must Die is a major opportunity: desync flaws bypass traditional fixes and netted the research team over $200k in bounties in just two weeks.
blog · portswigger.net
HTTP/1.1 Must Die: What This Means for Contract Pentesters and MSSPs
For contract pentesters and MSSPs, HTTP/1.1 Must Die highlights a service gap: demonstrating hidden desync risks in client environments can deliver findings competitors miss.
blog · portswigger.net
HTTP/1.1 must die: Dafydd Stuttard on what this means for enterprise security
Dafydd Stuttard explains the enterprise implications of James Kettle's HTTP desync research: any upstream HTTP/1.1 hop, including CDN downgrades, leaves organizations exposed to request smuggling.
blog · portswigger.net
The Desync Delusion: Are You Really Protected Against HTTP Request Smuggling?
Most DAST tools detect only basic CL.TE/TE.CL smuggling or fingerprint known CVEs; Burp Suite DAST probes desync primitives directly to deliver comprehensive request smuggling detection.
blog · portswigger.net
HTTP Request Smuggling Explained: with seasoned bug bounty hunter NahamSec and world-class researcher James Kettle
NahamSec and James Kettle break down request smuggling basics in a video: parser disagreements between front-end and back-end servers, HTTP/2 downgrades and real-world cases like Netflix.
Back