PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Twisted Version 19.10.0

bishopfox.com | blog | #request-smuggling | #python | #advisory | #http | #twisted
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

A Bishop Fox advisory: two HTTP request splitting (smuggling) flaws in Twisted Web 19.10.0 can cause cache poisoning, session hijacking, and filter bypasses; upgrade to 20.3.0rc1.
Published
Collected

Related coverage

research · portswigger.net
Beware the false false-positive: how to distinguish HTTP pipelining from request smuggling
Kettle explains how to distinguish HTTP pipelining false positives from real request smuggling, covering connection-locked smuggling, connection state attacks and client-side desync.
research · portswigger.net
Making desync attacks easy with TRACE
The ancient TRACE method mirrors requests in responses, turning near-unexploitable desync vulnerabilities into full compromise when nothing else carries a payload, as shown in a bug bounty case.
blog · bishopfox.com
h2c Smuggling: Request Smuggling Via HTTP/2 Cleartext (h2c)
Jake Miller demonstrates how upgrading HTTP/1.1 connections to HTTP/2 cleartext (h2c) can smuggle requests past reverse proxy access controls and establish long-lived back-end access.
blog · portswigger.net
HTTP/1.1 Must Die: Conquering the 0.CL Challenge
Guest author b3xal dissects 0.CL request smuggling—front-end honors Content-Length: 0 while the back-end does not—and solves PortSwigger's lab with four PoCs using XSS and HEAD techniques.
blog · portswigger.net
HTTP/1.1 Must Die: What This Means for Bug Bounty Hunters
For bug bounty hunters, HTTP/1.1 Must Die is a major opportunity: desync flaws bypass traditional fixes and netted the research team over $200k in bounties in just two weeks.
blog · portswigger.net
HTTP/1.1 Must Die: What This Means for Contract Pentesters and MSSPs
For contract pentesters and MSSPs, HTTP/1.1 Must Die highlights a service gap: demonstrating hidden desync risks in client environments can deliver findings competitors miss.
Back