PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

"The entire internet is broken": ethical hacking expert John Hammond meets James Kettle

portswigger.net | research | #http-desync | #request-smuggling | #james-kettle | #http1-must-die | #video | #http2
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

John Hammond and James Kettle discuss the HTTP/1.1 Must Die research in a video, covering new desync attack classes, CDN compromises, and the case for moving upstream connections to HTTP/2.
Published
Collected

Related coverage

blog · portswigger.net
HTTP Request Smuggling Explained: with seasoned bug bounty hunter NahamSec and world-class researcher James Kettle
NahamSec and James Kettle break down request smuggling basics in a video: parser disagreements between front-end and back-end servers, HTTP/2 downgrades and real-world cases like Netflix.
blog · portswigger.net
HTTP/1.1 must die: Dafydd Stuttard on what this means for enterprise security
Dafydd Stuttard explains the enterprise implications of James Kettle's HTTP desync research: any upstream HTTP/1.1 hop, including CDN downgrades, leaves organizations exposed to request smuggling.
blog · portswigger.net
HTTP/1.1 Must Die: What This Means for Contract Pentesters and MSSPs
For contract pentesters and MSSPs, HTTP/1.1 Must Die highlights a service gap: demonstrating hidden desync risks in client environments can deliver findings competitors miss.
blog · portswigger.net
Black Hat USA 2021: PortSwigger's latest research to be unveiled
James Kettle's Black Hat USA 2021 talk 'HTTP/2: The Sequel is Always Worse' unveils HTTP/2-exclusive desync attacks, cache poisoning and password theft, with Burp Suite support to follow.
research · portswigger.net
Can AI do novel security research? Meet the HTTP Terminator
James Kettle's Black Hat USA 2026 research: the HTTP Terminator, an autonomous system that invented novel HTTP desync triggers and exploited banks, security products and government infrastructure.
research · portswigger.net
CRLF-Powered Desync Attacks: Beheading HTTP Streams
PortSwigger turns HTTP header injection into a desync worm, with novel methods that shift IP- and connection-locked desyncs into the victim's browser to create XSS and steal HTTPOnly cookies.
Back