Writeups · logicbreaker

Writeups

All xss sql-injection csrf clickjacking

2026-09-23 Insane

Server-side pause-based request smuggling

pause based smuggling where the front end streams bytes to a buggy apache back end, so sending a POST /resources header then pausing 61 seconds fires an instant redirect and holds the connection open, turning the delayed body into a smuggled admin request

HTTP request smuggling

HTTP request smuggling 7 min
2026-09-21 Insane

Client-side desync

client side desync where no front end is needed, an endpoint that ignores Content-Length plus browser connection reuse lets a victim's own browser smuggle a request against itself, captured into a stored comment via fetch to leak and reuse their session cookie

HTTP request smuggling

HTTP request smuggling 13 min
2026-09-18 Insane

Web cache poisoning via HTTP/2 request tunnelling

web cache poisoning built on http/2 tunnelling, injecting a second request through the :path pseudo header and reading its nested response with a HEAD request, then tunnelling a reflected xss from the /resources gadget, padding it past the Content-Length, and caching it under the home page

HTTP request smuggling

HTTP request smuggling 7 min
2026-09-17 Insane

Bypassing access controls via HTTP/2 request tunnelling

http/2 request tunnelling that beats a front end which never reuses back end connections, injecting crlf into header names to leak the internal X-SSL and X-FRONTEND-KEY auth headers through the search reflection, then forging them to tunnel an admin request

HTTP request smuggling

HTTP request smuggling 9 min
2026-09-17 Medium

Exploiting HTTP request smuggling to perform web cache deception

web cache deception via smuggling, where the account page carries no anti caching header, so a smuggled /my-account request running under the victim's session lands their api key in the cache under a static assets

HTTP request smuggling

HTTP request smuggling 4 min
2026-09-17 Hard

Exploiting HTTP request smuggling to perform web cache poisoning

request smuggling turned into web cache poisoning, smuggling a next post redirect with our exploit server as the Host so it gets cached under tracking.js, and timing it against the Age header

HTTP request smuggling

HTTP request smuggling 7 min
2026-09-17 Easy

HTTP request smuggling, obfuscating the TE header

te.cl desync between two servers that both support chunked, forced by sending Transfer-Encoding twice

HTTP request smuggling

HTTP request smuggling 2 min