PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Browser-Powered Desync Attacks: A New Frontier in HTTP Request Smuggling

portswigger.net | research | #black-hat | #web-security | #request-smuggling | #desync | #client-side-desync | #pause-based-desync
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

James Kettle turns victims' browsers into desync delivery platforms, exposing single-server sites and internal networks via client-side and pause-based desync against Apache, Varnish and web VPNs.
Published
Collected

Related coverage

research · portswigger.net
HTTP/2: The Sequel is Always Worse
HTTP/2-exclusive desync attacks: implementation flaws and RFC imperfections enable cache poisoning, credential theft and request tunnelling against ALB, WAFs and CDNs, netting multiple max bounties.
research · portswigger.net
Can AI do novel security research? Meet the HTTP Terminator
James Kettle's Black Hat USA 2026 research: the HTTP Terminator, an autonomous system that invented novel HTTP desync triggers and exploited banks, security products and government infrastructure.
research · portswigger.net
HTTP Desync Attacks: Request Smuggling Reborn
James Kettle revives HTTP Request Smuggling as HTTP Desync Attacks, splicing requests into victims' connections to poison caches and compromise PayPal's login page, earning over $70k in bounties.
research · portswigger.net
Beware the false false-positive: how to distinguish HTTP pipelining from request smuggling
Kettle explains how to distinguish HTTP pipelining false positives from real request smuggling, covering connection-locked smuggling, connection state attacks and client-side desync.
research · portswigger.net
Making desync attacks easy with TRACE
The ancient TRACE method mirrors requests in responses, turning near-unexploitable desync vulnerabilities into full compromise when nothing else carries a payload, as shown in a bug bounty case.
research · portswigger.net
How to turn security research into profit: a CL.0 case study
Strategies for turning security research into bounty profit, using the CL.0 desync class as a case study: assess competition, find gaps in released scanners, and act before a technique saturates.
Back