Writing on web security

A guide to detecting HTTP request smuggling with timing based probes, differential responses, and teardown that confirms a real desync without poisoning…

How connection state request smuggling works: a front end validates the first request, then reuses that trust and routing for later requests…

A request tunnelling attack opens a direct pipe through the front end to the back end so routing and access rules never…

How capturing other users requests works: smuggle a prefix into a stored and reflected endpoint so a victim’s cookies and body land…

How a request smuggling WAF bypass works: a blocked request hides in a body the filter reads as data, then the back…

How request smuggling cache poisoning works: a desync lets an attacker control what a cache stores, so content is saved under a…

How response queue poisoning works: once a connection is desynced, responses fall out of step with requests and each later user gets…

A pause based desync attack splits an HTTP connection using a server read timeout or early response, no header trick, so a…

CL.0 request smuggling happens when a back end endpoint treats the body as length zero, so the body the front end forwarded…

With browser powered request smuggling the victim’s own browser sends the crafted request, so the smuggled prefix rides their connection and cookies.