Skip to content
Beware the false false-positive: how to distinguish HTTP pipelining from request smuggling
portswigger.net | research | #burp-suite | #request-smuggling | #false-positives | #http | #desync | #pipelining
Summary
Kettle explains how to distinguish HTTP pipelining false positives from real request smuggling, covering connection-locked smuggling, connection state attacks and client-side desync.
- Published
- Collected