Writeups · logicbreaker

Writeups

All xss sql-injection csrf clickjacking

2026-09-15 Medium

CL.0 request smuggling

cl.0 smuggling where the back end ignores Content-Length on certain endpoints

HTTP request smuggling

HTTP request smuggling 3 min
2026-09-15 Medium

HTTP/2 request splitting via CRLF injection

http/2 request splitting where injected crlf characters split one request into two complete ones after the downgrade

HTTP request smuggling

HTTP request smuggling 5 min
2026-09-15 Insane

HTTP/2 request smuggling via CRLF injection

http/2 exclusive smuggling where a carriage return and line feed hidden in a header value is harmless data over http/2 but splits into a real Transfer-Encoding header once the front end downgrades to http/1, giving a desync that captures the victim's session cookie into our own search history

HTTP request smuggling

HTTP request smuggling 9 min
2026-09-15 Medium

H2.CL request smuggling

h2.cl smuggling where the front end downgrades http/2 but keeps our injected Content-Length 0, so the back end reads our request as empty and the smuggled resources prefix redirects the victim to a malicious script

HTTP request smuggling

HTTP request smuggling 4 min
2026-09-15 Hard

Response queue poisoning via H2.TE request smuggling

h2.te smuggling where the front end downgrades http/2 and keeps our Transfer-Encoding header

HTTP request smuggling

HTTP request smuggling 7 min
2026-09-15 Hard

Exploiting HTTP request smuggling to deliver reflected XSS

request smuggling as a delivery vehicle for reflected xss, smuggling a request whose malicious User-Agent poisons the response queue so the next visitor's browser runs

HTTP request smuggling

HTTP request smuggling 4 min
2026-09-15 Medium

Exploiting HTTP request smuggling to capture other users requests

request smuggling that steals a live victim's session, smuggling a comment post whose oversized Content-Length swallows the next user's whole request into the stored comment

HTTP request smuggling

HTTP request smuggling 3 min