Workshop: HTTP Request Smuggling

HTTP request smuggling is difficult to understand (payloads can be confusing at first site) and the exploitation is no different. What better way to understand this trending new vulnerability than by seeing it from an attacker perspective. It will be an overview of the latest research on the topic.

Load balancers and proxies, such as HAProxy, Varnish, Squid, and nginx play a crucial role in website performance, and they all have a different HTTP protocol parser implemented. HTTP Request Smuggling (HRS) is an attack abusing inconsistencies between the interpretation of request ending by HTTP request parsers. What might be considered the end of one request for your load balancer might not be considered as such by your web server.

We will see how an attacker can abuse several vulnerable configurations. HTTP Request Smugging (HRS) enables multiple attack vectors, including cache poisoning, credential hijacking, URL filtering bypass, open-redirect and persistent XSS. For each of these vectors, a payload will be showcased and explained in-depth. Also, a live demonstration will be made to see the vulnerability in action. Aside from exploitation, we will show how developers and system administrators can detect such faulty configurations using automated tools.