HTTP/1.1 Must Die! The Desync Endgame
James Kettle unleashes novel HTTP request smuggling and desync attack classes against modern web infrastructure, arguing for the retirement of HTTP/1.1.
Summary
The Persistent Peril of HTTP/1.1 Framing
HTTP/1.1 request parsing relies on ambiguous Content-Length and Transfer-Encoding header delimiters. Despite years of patch efforts, parsing discrepancies between front-end reverse proxies and backend servers continue to spawn critical request smuggling vulnerabilities.
New Desync Primitives and Parser Differentials
James Kettle presents the latest evolution of desync attacks, demonstrating novel techniques to bypass WAFs, poison web caches, and desynchronize connections across complex multi-tiered cloud architectures.
Weaponizing Request Smuggling in Production
Real-world case studies illustrate how subtle protocol desynchronization allows unauthenticated attackers to hijack user sessions, bypass authentication gateways, and steal sensitive credentials.
The Endgame: Moving Beyond HTTP/1.1
Kettle argues that fundamental protocol design flaws make HTTP/1.1 impossible to parse securely at scale, urging the web ecosystem to transition fully to binary, length-delimited protocols like HTTP/2 and HTTP/3.
Related talks
Creator Stage·25 min
Whit Taylor
Uncovers client-side gadgets, race conditions, and business logic flaws hidden within referral and reward systems across major bug bounty programs.
App Sec Village·32 min
Paulo Silva · David Sopas
Vulnerability chaining and web application research uncovering flaws across eleven major automotive manufacturers.
App Sec Village·29 min
Ian Hickey
Exploits URL path handling differentials to turn trusted websites into malware delivery platforms using Relative Path File Injection.