Scomurr's Blog – Play for serendipity…

HTTP Request Smuggling – HTTP/2 Request Tunnelling

03/19/2023 scomurr Security, Web Attacks
HTTP Request Smuggling – Web Cache Poisoning for Deception

03/12/2023 scomurr Security, Web Attacks
HTTP Request Smuggling – Web Cache Poisoning

03/05/2023 scomurr Security, Web Attacks
HTTP Request Smuggling – Admin Access via CL.0 Vulnerability

02/25/2023 scomurr Security, Web Attacks
HTTP Request Smuggling–H2 CRLF Header Injection Part 2

02/20/2023 scomurr Security, Web Attacks
HTTP Request Smuggling – H2 CRLF Injection

01/27/2023 scomurr Security, Web Attacks
HTTP Request Smuggling – HTTP/2 Downgrade Attack Part 2

01/25/2023 scomurr Security, Web Attacks
HTTP Request Smuggling – HTTP/2 Downgrade Attack

01/23/2023 scomurr Security, Web Attacks

HTTP Request Smuggling – HTTP/2 Request Tunnelling

03/19/2023 scomurr Security, Web Attacks

Time for another one of the advanced labs on the PortSwigger Web Security Academy. For this lab, we are dealing[…]

Read more

HTTP Request Smuggling – Web Cache Poisoning for Deception

03/12/2023 scomurr Security, Web Attacks

This lab is a bit similar to the last, however, it has a completely different purpose. In the previous, we[…]

Read more

HTTP Request Smuggling – Web Cache Poisoning

03/05/2023 scomurr Security, Web Attacks

This lab is a lot of fun and requires chaining together techniques to fully exploit. First, we have to identify[…]

Read more

HTTP Request Smuggling – Admin Access via CL.0 Vulnerability

02/25/2023 scomurr Security, Web Attacks

This next lab represents an interesting vulnerability where specific paths/routes within an application are vulnerable to desync when there is[…]

Read more

HTTP Request Smuggling–H2 CRLF Header Injection Part 2

02/20/2023 scomurr Security, Web Attacks

In the previous post, we looked at an HTTP/2 downgrade attack where we injected CRLF characters into a header and[…]

Read more