PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Cracking the lens: targeting HTTP's hidden attack-surface

portswigger.net | research | #bug-bounty | #attack-surface | #portswigger | #http | #ssrf | #dod | #reverse-proxy
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

James Kettle cracks the lens of hidden HTTP infrastructure, using malformed requests and esoteric headers to expose reverse proxies and ISP interception, earning over $30k in bounties.
Published
Collected

Related coverage

research · portswigger.net
What's in a tag name? JavaScript, apparently
This research provides technical context that security teams can use for monitoring and validation.
research · portswigger.net
CRLF-Powered Desync Attacks: Beheading HTTP Streams
PortSwigger turns HTTP header injection into a desync worm, with novel methods that shift IP- and connection-locked desyncs into the victim's browser to create XSS and steal HTTPOnly cookies.
research · portswigger.net
Introducing HTTP Anomaly Rank
James Kettle introduces HTTP Anomaly Rank, an algorithm that surfaces the most interesting HTTP responses from huge result sets. It ships in Turbo Intruder and Burp Suite's 2025.10 API.
research · portswigger.net
Practical Web Cache Poisoning
James Kettle's whitepaper shows how to turn web caches into exploit delivery systems, hijacking JavaScript and poisoning responses across popular sites, plus defenses and open source tooling.
research · portswigger.net
Beware the false false-positive: how to distinguish HTTP pipelining from request smuggling
Kettle explains how to distinguish HTTP pipelining false positives from real request smuggling, covering connection-locked smuggling, connection state attacks and client-side desync.
research · portswigger.net
So you want to be a web security researcher?
James Kettle shares guidance on becoming a web security researcher: mastering the state of the art, breaking into the industry, bug bounty paths and recommended resources.
Back