Skip to content
HTTP/1.1 must die: the desync endgame
portswigger.net | research | #http-desync | #request-smuggling | #cloudflare | #research | #netlify | #akamai | #cdn-security
Summary
HTTP/1.1 desync attacks can mass-compromise credentials via flaws in Akamai, Cloudflare and Netlify. A parser-discrepancy toolkit earned $200,000 in two weeks — Kettle argues HTTP/1.1 must die.
- Published
- Collected