Learning security in the open :)
I’m a Penetration tester. I write up each topic as I learn it
the Vulnerabilities, the Tools, the Concepts that finally clicked
- 111writeups
- 110boxes rooted
- 5Certification
Latest writeups
All writeups-
Insane
Server-side pause-based request smuggling
pause based smuggling where the front end streams bytes to a buggy apache back end, so sending a POST /resources header then pausing 61 seconds fires an instant redirect and holds the connection open, turning the delayed body into a smuggled admin request
HTTP request smuggling 7 min -
Insane
Client-side desync
client side desync where no front end is needed, an endpoint that ignores Content-Length plus browser connection reuse lets a victim's own browser smuggle a request against itself, captured into a stored comment via fetch to leak and reuse their session cookie
HTTP request smuggling 13 min -
Insane
Web cache poisoning via HTTP/2 request tunnelling
web cache poisoning built on http/2 tunnelling, injecting a second request through the :path pseudo header and reading its nested response with a HEAD request, then tunnelling a reflected xss from the /resources gadget, padding it past the Content-Length, and caching it under the home page
HTTP request smuggling 7 min -
Insane
Bypassing access controls via HTTP/2 request tunnelling
http/2 request tunnelling that beats a front end which never reuses back end connections, injecting crlf into header names to leak the internal X-SSL and X-FRONTEND-KEY auth headers through the search reflection, then forging them to tunnel an admin request
HTTP request smuggling 9 min -
Medium
Exploiting HTTP request smuggling to perform web cache deception
web cache deception via smuggling, where the account page carries no anti caching header, so a smuggled /my-account request running under the victim's session lands their api key in the cache under a static assets
HTTP request smuggling 4 min -
Hard
Exploiting HTTP request smuggling to perform web cache poisoning
request smuggling turned into web cache poisoning, smuggling a next post redirect with our exploit server as the Host so it gets cached under tracking.js, and timing it against the Age header
HTTP request smuggling 7 min -
Easy
HTTP request smuggling, obfuscating the TE header
te.cl desync between two servers that both support chunked, forced by sending Transfer-Encoding twice
HTTP request smuggling 2 min