PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

The Desync Delusion: Are You Really Protected Against HTTP Request Smuggling?

portswigger.net | blog | #http-desync | #request-smuggling | #detection | #portswigger | #dast | #burp-suite-dast
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Most DAST tools detect only basic CL.TE/TE.CL smuggling or fingerprint known CVEs; Burp Suite DAST probes desync primitives directly to deliver comprehensive request smuggling detection.
Published
Collected

Related coverage

research · portswigger.net
CRLF-Powered Desync Attacks: Beheading HTTP Streams
PortSwigger turns HTTP header injection into a desync worm, with novel methods that shift IP- and connection-locked desyncs into the victim's browser to create XSS and steal HTTPOnly cookies.
blog · portswigger.net
PHP2Shell x Burp Suite: Detection in your hands within a day of disclosure
PHP2Shell (CVE-2026-109618 and CVE-2026-109619) became the latest vulnerability to grab headlines around the globe. By some estimates, up to 70% of websites run at least some PHP. So if you're respons
blog · portswigger.net
Can AI invent new attack techniques? New research from James Kettle and PortSwigger Research
This coverage gives security teams current context for monitoring, validation, and remediation.
blog · portswigger.net
HTTP/1.1 Must Die: What This Means for Bug Bounty Hunters
For bug bounty hunters, HTTP/1.1 Must Die is a major opportunity: desync flaws bypass traditional fixes and netted the research team over $200k in bounties in just two weeks.
blog · portswigger.net
HTTP/1.1 Must Die: What This Means for Contract Pentesters and MSSPs
For contract pentesters and MSSPs, HTTP/1.1 Must Die highlights a service gap: demonstrating hidden desync risks in client environments can deliver findings competitors miss.
blog · portswigger.net
HTTP Request Smuggling Explained: with seasoned bug bounty hunter NahamSec and world-class researcher James Kettle
NahamSec and James Kettle break down request smuggling basics in a video: parser disagreements between front-end and back-end servers, HTTP/2 downgrades and real-world cases like Netflix.
Back