Browser-Powered Desync Attacks: A New Frontier in HTTP Request Smuggling
PortSwigger head of research James Kettle unveils browser-powered desync attacks, turning victim web browsers into desynchronization weapons against major websites.
Summary
The Evolution of HTTP Request Smuggling
HTTP Request Smuggling historically required direct socket-level control to send malformed byte sequences between reverse proxies and backend servers.
Weaponizing Web Browsers for Desync Exploitation
James Kettle demonstrates how subtle protocol desynchronization bugs can be triggered directly from standard web browsers using JavaScript fetch and XMLHttpRequest.
Client-Side Desyncs and Request Hijacking
Kettle illustrates exploiting HTTP/1.1 pipeline reuse and HTTP/2 downgrade ambiguities to poison browser connection pools, hijack victim sessions, and steal credentials.
Hardening Next-Generation Web Architecture
The author provides open-source detection extensions (HTTP Request Smuggler) and actionable advice on end-to-end HTTP/2 enforcement.
Related talks
Main Stage·37 min
James 'albinowax' Kettle
James Kettle unleashes novel HTTP request smuggling and desync attack classes against modern web infrastructure, arguing for the retirement of HTTP/1.1.
Main Stage·44 min
Martin Doyhenard
New classes of web cache poisoning and cache deception vulnerabilities exploiting parser discrepancies between CDNs and origin servers.
Main Stage·40 min
Dongsung Kim
Dongsung Kim demonstrates how modern browser features and emerging Web APIs can be chained to resurrect Cross-Site Request Forgery (CSRF) despite SameSite cookies.