PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

HTTP/2: The Sequel is Always Worse

portswigger.net | research | #black-hat | #web-security | #request-smuggling | #http2 | #desync | #request-tunnelling
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

HTTP/2-exclusive desync attacks: implementation flaws and RFC imperfections enable cache poisoning, credential theft and request tunnelling against ALB, WAFs and CDNs, netting multiple max bounties.
Published
Collected

Related coverage

research · portswigger.net
Browser-Powered Desync Attacks: A New Frontier in HTTP Request Smuggling
James Kettle turns victims' browsers into desync delivery platforms, exposing single-server sites and internal networks via client-side and pause-based desync against Apache, Varnish and web VPNs.
blog · portswigger.net
Black Hat USA 2021: PortSwigger's latest research to be unveiled
James Kettle's Black Hat USA 2021 talk 'HTTP/2: The Sequel is Always Worse' unveils HTTP/2-exclusive desync attacks, cache poisoning and password theft, with Burp Suite support to follow.
research · portswigger.net
Can AI do novel security research? Meet the HTTP Terminator
James Kettle's Black Hat USA 2026 research: the HTTP Terminator, an autonomous system that invented novel HTTP desync triggers and exploited banks, security products and government infrastructure.
research · portswigger.net
HTTP Desync Attacks: Request Smuggling Reborn
James Kettle revives HTTP Request Smuggling as HTTP Desync Attacks, splicing requests into victims' connections to poison caches and compromise PayPal's login page, earning over $70k in bounties.
research · portswigger.net
Beware the false false-positive: how to distinguish HTTP pipelining from request smuggling
Kettle explains how to distinguish HTTP pipelining false positives from real request smuggling, covering connection-locked smuggling, connection state attacks and client-side desync.
research · portswigger.net
Making desync attacks easy with TRACE
The ancient TRACE method mirrors requests in responses, turning near-unexploitable desync vulnerabilities into full compromise when nothing else carries a payload, as shown in a bug bounty case.
Back