Writing on web security

A client side desync attack poisons the single connection a victim browser holds open, so one server that ignores a request body…

HTTP/2 CRLF header injection happens when a value carries bytes HTTP/1.1 forbids, so an HTTP/2 front end rewrites them into real header…

How HTTP/2 request splitting works: newlines hidden in HTTP/2 headers survive the downgrade to HTTP/1.1 and split one request into two at…

How h2c smuggling works: a front end forwards an upgrade handshake, a client opens a cleartext HTTP/2 tunnel to the back end,…

How HTTP/2 downgrade smuggling works: a front end rewrites HTTP/2 to HTTP/1.1 and reopens the length ambiguity that end to end HTTP/2…

How transfer encoding obfuscation makes a front end and a back end read one chunked header two different ways and desync a…

duplicate content length smuggling is when a request carries two Content Length headers and two servers pick different values, framing a hidden…

TE.TE request smuggling works when both servers support chunked, so you obfuscate the Transfer Encoding header until one falls back to Content…

TE.CL request smuggling flips the desync: the front end reads chunked and the back end reads Content Length, so careful byte math…

CL.TE request smuggling is when the front end reads Content Length and the back end reads chunked Transfer Encoding, splitting one request…