HTTP request smuggling

In-Depth Analysis of HTTP Request Smuggling (HRS) Vulnerability Exploitation

by

1. Basics of Protocol Desynchronization (desync): Architectural Prerequisites for HRS HTTP Request Smuggling (HRS) is a protocol-level attack technique that primarily disrupts the way websites process sequences of consecutive HTTP requests. 1This vulnerability is characterized by “protocol desynchronization” rather than application logic errors, leading to potentially catastrophic consequences, such as bypassing security controls, unauthorized access … Read more

Summary of HTTP Request Smuggling and Automation Testing

by
Summary of HTTP Request Smuggling and Automation Testing

Introduction This article mainly introduces the principles of HTTP request smuggling vulnerabilities, common types of vulnerabilities, and testing methods. At the end of the article, automated testing methods and tools are provided for those in need.0x01 Vulnerability Overview HTTP Request Smuggling is an attack technique that exploits the differences in HTTP protocol parsing between front-end … Read more

Critical Vulnerability in HTTP/1.1 Poses Malicious Takeover Risk for Millions of Websites

by
Critical Vulnerability in HTTP/1.1 Poses Malicious Takeover Risk for Millions of Websites

A critical vulnerability exists in the HTTP/1.1 protocol that could expose tens of millions of websites to malicious takeover risks through complex desynchronization attacks. This foundational protocol flaw, present for decades, creates extremely blurred request boundaries, allowing attackers to manipulate network traffic and compromise entire infrastructures.Part01 Analysis of the Critical Vulnerability in HTTP/1.1 A report … Read more

The Shadow Inside: Why HTTP Smuggling Still Disrupts Networks

by
The Shadow Inside: Why HTTP Smuggling Still Disrupts Networks

DELE 4 Generation In the ever-evolving battlefield of web application security, firewalls are becoming increasingly intelligent, and scanners are becoming more aggressive, yet some vulnerabilities still **slip silently through the cracks**. One of these — **HTTP Request Smuggling (HRS)** — has once again emerged as a *high-impact*, *low-visibility* threat capable of bypassing authentication, hijacking sessions, … Read more

Default HTTP Request Values in JMeter

by
Default HTTP Request Values in JMeter

Function Introduction When editing a test plan in JMeter, if there are multiple Sampler requests with the same parameters and settings, such as the protocol, IP address, and port number of the service being requested, configuring each Sampler individually would increase redundancy and workload. Additionally, if the server address changes in the future, it would … Read more

Go 1.24.2 Released: Major Security Vulnerability Fix in net/http – Is Your Service Safe?

by
Go 1.24.2 Released: Major Security Vulnerability Fix in net/http - Is Your Service Safe?

📢 Latest News On April 2, 2025, Beijing time, the official Go team urgently released Go 1.24.2 and Go 1.23.8, focusing on fixing a critical security vulnerability in the <span><span>net/http</span></span> package—HTTP Request Smuggling (CVE-2025-22871). This vulnerability could allow malicious attackers to bypass security checks, construct illegal requests, and threaten server security. 🚨 Vulnerability Impact Scope … Read more