---
id: 5532
title: "Cracking the lens: targeting HTTP's hidden attack-surface"
source_domain: portswigger.net
source_url: "https://portswigger.net/research/cracking-the-lens-targeting-https-hidden-attack-surface"
published_at: "2025-09-03T07:38:00Z"
tags: ["bug-bounty", "attack-surface", "portswigger", "http", "ssrf", "dod", "reverse-proxy"]
phying_url: "https://phying.com/item/5532"
lang: en
---

# Cracking the lens: targeting HTTP's hidden attack-surface

## Summary

James Kettle cracks the lens of hidden HTTP infrastructure, using malformed requests and esoteric headers to expose reverse proxies and ISP interception, earning over $30k in bounties.

## Intelligence Metadata

- **Sources:** portswigger.net
- **Published:** 2025-09-03T07:38:00Z
- **Original:** https://portswigger.net/research/cracking-the-lens-targeting-https-hidden-attack-surface
- **Phying News:** https://phying.com/item/5532