PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

The ultimate Bug Bounty guide to HTTP request smuggling vulnerabilities

yeswehack.com | research | #bug-bounty | #web-security | #detection | #http-request-smuggling | #http2 | #guide | #cwe-444
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

A practical guide to HTTP request smuggling (CWE-444): CL.TE, TE.CL, TE.TE and HTTP/2 variants, detection workflow and tools, real-world CVEs, and mitigation advice.
Published
Collected

Related coverage

vulnerability · vercel.com
The Vercel Bug Bounty Program is now publicly available
Vercel's Bug Bounty Program is now public on HackerOne, covering all Vercel products and open-source projects. Learn how to participate and report findings.
vulnerability · vercel.com
The Vercel OSS Bug Bounty program is now available
Vercel is opening its open source software bug bounty program to the public for researchers find vulnerabilities and make OSS safer
vulnerability · vercel.com
Our $1 million hacker challenge for React2Shell
We paid $1M to security researchers to break our WAF. Here's what we learned defending against React2Shell.
research · portswigger.net
Top 10 web hacking techniques of 2025
PortSwigger's 19th annual Top 10 Web Hacking Techniques, drawn from 63 community nominations and ranked by an expert panel including James Kettle — the must-read web security research of 2025.
research · portswigger.net
HTTP/2: The Sequel is Always Worse
HTTP/2-exclusive desync attacks: implementation flaws and RFC imperfections enable cache poisoning, credential theft and request tunnelling against ALB, WAFs and CDNs, netting multiple max bounties.
research · portswigger.net
"The entire internet is broken": ethical hacking expert John Hammond meets James Kettle
John Hammond and James Kettle discuss the HTTP/1.1 Must Die research in a video, covering new desync attack classes, CDN compromises, and the case for moving upstream connections to HTTP/2.
Back