Beware the false false-positive: how to distinguish HTTP pipelining from request smuggling
portswigger.net | research | #burp-suite | #request-smuggling | #false-positives | #http | #desync | #pipelining
Summary
Kettle explains how to distinguish HTTP pipelining false positives from real request smuggling, covering connection-locked smuggling, connection state attacks and client-side desync.
- Published
- Collected
--- id: 5039 title: "Beware the false false-positive: how to distinguish HTTP pipelining from request smuggling" source_domain: portswigger.net source_url: "https://portswigger.net/research/how-to-distinguish-http-pipelining-from-request-smuggling" published_at: "2025-08-19 14:31" tags: ["burp-suite", "request-smuggling", "false-positives", "http", "desync", "pipelining"] phying_url: "https://phying.com/item/5039" lang: en --- # Beware the false false-positive: how to distinguish HTTP pipelining from request smuggling ## Summary Kettle explains how to distinguish HTTP pipelining false positives from real request smuggling, covering connection-locked smuggling, connection state attacks and client-side desync. ## Intelligence Metadata - **Sources:** portswigger.net - **Published:** 2025-08-19 14:31 - **Original:** https://portswigger.net/research/how-to-distinguish-http-pipelining-from-request-smuggling - **Phying News:** https://phying.com/item/5039