Loading video...

Video Failed to Load

There was a problem loading this video. This could be due to a temporary network issue or the video might be unavailable.

HTTP is supposed to be stateless, but sometimes... it isn't! Some servers create invisible vulnerabilities by only validating the first request on each TCP/TLS connection. I've just published a Custom Action to help you detect & exploit this - here's a narrated demo:

James Kettle

83,707 subscribers

139,758 views • 8 months ago •via X (Twitter)

Science & Technology

Anya Rossi• Live Now

Private livecam show

0 Comments

No comments available

Comments from the original post will appear here

Related Videos

What is HTTP Downgrading, why use it, and how does it work? HTTP/2 is default for most web apps these days, however, it's not uncommon for backend servers to still use HTTP/1.1 causing parsing mismatches between frontend and backend. And that's where HTTP downgrading comes in! But what is it? HTTP downgrading is the process of forcing a request to be processed under HTTP/1.1 instead of HTTP/2. This allows you to manipulate how the frontend and backend servers interpret requests and exploit vulnerabilities unique to HTTP/1.1 parsing such as Content-Length Transfer-Encoding (CL.TE) attacks. How to downgrade HTTP/2 to HTTP/1.1 using Burp Suite 1️⃣ Open Burp Suite and Navigate to Proxy → HTTP History 2️⃣ Locate the request that is currently using HTTP/2. 3️⃣ Send the Request to Repeater 4️⃣ In the Repeater tab, open the "Inspector" panel → Request Attributes → Protocol 5️⃣ Change HTTP Version to HTTP/1.1 6️⃣ Click "Send" in Repeater. If successful, you should receive a valid response, confirming the server accepts HTTP/1.1. And that's it! You've just downgraded the HTTP protocol and confirmed that the frontend server accepts HTTP/1.1! 🥳 You are now ready to smuggle requests! If you want to learn how to exploit this, we've got a Web Academy Lab you need to check out: Thanks for reading! #requestsmuggling #cybersecurity #BurpSuite #hacking #infosec

What is HTTP Downgrading, why use it, and how does it work? HTTP/2 is default for most web apps these days, however, it's not uncommon for backend servers to still use HTTP/1.1 causing parsing mismatches between frontend and backend. And that's where HTTP downgrading comes in! But what is it? HTTP downgrading is the process of forcing a request to be processed under HTTP/1.1 instead of HTTP/2. This allows you to manipulate how the frontend and backend servers interpret requests and exploit vulnerabilities unique to HTTP/1.1 parsing such as Content-Length Transfer-Encoding (CL.TE) attacks. How to downgrade HTTP/2 to HTTP/1.1 using Burp Suite 1️⃣ Open Burp Suite and Navigate to Proxy → HTTP History 2️⃣ Locate the request that is currently using HTTP/2. 3️⃣ Send the Request to Repeater 4️⃣ In the Repeater tab, open the "Inspector" panel → Request Attributes → Protocol 5️⃣ Change HTTP Version to HTTP/1.1 6️⃣ Click "Send" in Repeater. If successful, you should receive a valid response, confirming the server accepts HTTP/1.1. And that's it! You've just downgraded the HTTP protocol and confirmed that the frontend server accepts HTTP/1.1! 🥳 You are now ready to smuggle requests! If you want to learn how to exploit this, we've got a Web Academy Lab you need to check out: Thanks for reading! #requestsmuggling #cybersecurity #BurpSuite #hacking #infosec

Web Security Academy

62,639 views • 1 year ago

Built a C socket library that goes from raw TCP all the way up to gRPC over HTTP/3. No external dependencies for the core stack. HTTP/1.1/2/3, QUIC, WebSocket, TLS 1.3, DNSSEC, DEFLATE, io_uring, connection pooling. The only C library with native gRPC over HTTP/3.

Built a C socket library that goes from raw TCP all the way up to gRPC over HTTP/3. No external dependencies for the core stack. HTTP/1.1/2/3, QUIC, WebSocket, TLS 1.3, DNSSEC, DEFLATE, io_uring, connection pooling. The only C library with native gRPC over HTTP/3.

tetsuo

210,667 views • 4 months ago

This is supposed to be a mistake by Vuskovic here but my methodology screams ‘This is a superstar!’ Can you tell how? Why? Open only to people I've not explained my methodology to. Can you figure out the secrets to my palm reading?

This is supposed to be a mistake by Vuskovic here but my methodology screams ‘This is a superstar!’ Can you tell how? Why? Open only to people I've not explained my methodology to. Can you figure out the secrets to my palm reading?

AI

552,534 views • 2 years ago

"This is just a plane. Donald Trump put a sign on it and said it was Air Force 1. But AF1 isn't supposed to be just a plane. It is supposed to protect continuity of government." The Qatar plane has none of those security specifications, which I lay out specifically here. @cnn

"This is just a plane. Donald Trump put a sign on it and said it was Air Force 1. But AF1 isn't supposed to be just a plane. It is supposed to protect continuity of government." The Qatar plane has none of those security specifications, which I lay out specifically here. @cnn

Juliette Kayyem

1,662,257 views • 1 year ago

AtenaSploit ☢ Atenasploit is a penetration testing framework designed to exploit critical vulnerabilities using unique and custom methods.

AtenaSploit ☢ Atenasploit is a penetration testing framework designed to exploit critical vulnerabilities using unique and custom methods.

0b1d1

15,411 views • 1 year ago

Unruly, the history book I've written, is published today! So you can get it in shops! Or by clicking on the link below! To celebrate that fact, here is a video reflecting on one of the key lessons I've taken from the past: sometimes things just happen.

Unruly, the history book I've written, is published today! So you can get it in shops! Or by clicking on the link below! To celebrate that fact, here is a video reflecting on one of the key lessons I've taken from the past: sometimes things just happen.

David Mitchell

102,605 views • 2 years ago

HTTP Request Smuggling Lab Walkthrough: Confirming a CL.TE vulnerability via differential responses. How to identify CLTE Vulnerabilities: 1. Send request to repeater 2. Downgrade protocol to HTTP/1.1 3. Disable "Update Content-Length" 4. Set Content-Length to 6 5. Add "Transfer-Encoding: chunked" heading 6. Send a chunk with an invalid chunk size If the backend times out, this indicates a potential CLTE vulnerability. Confirm the vulnerability with differential responses: 7. Create and send the attack request: - Replace previous chunk with a terminating chunk. - Add a smuggled request after the chunked body. - Append X-ignore: X (without a newline) and send. 8. Send a normal request to repeater, downgrade to HTTP/1.1 and send immediately after the attack request. If the response to the normal request is 404 instead of 200, the backend was poisoned! 🤮 Well done! To learn more about HTTP Request Smuggling and take on this lab yourself, head over the the Web Security Academy now #requestsmuggling #pentesting #bugbounty #hacking #cybersecurity

HTTP Request Smuggling Lab Walkthrough: Confirming a CL.TE vulnerability via differential responses. How to identify CLTE Vulnerabilities: 1. Send request to repeater 2. Downgrade protocol to HTTP/1.1 3. Disable "Update Content-Length" 4. Set Content-Length to 6 5. Add "Transfer-Encoding: chunked" heading 6. Send a chunk with an invalid chunk size If the backend times out, this indicates a potential CLTE vulnerability. Confirm the vulnerability with differential responses: 7. Create and send the attack request: - Replace previous chunk with a terminating chunk. - Add a smuggled request after the chunked body. - Append X-ignore: X (without a newline) and send. 8. Send a normal request to repeater, downgrade to HTTP/1.1 and send immediately after the attack request. If the response to the normal request is 404 instead of 200, the backend was poisoned! 🤮 Well done! To learn more about HTTP Request Smuggling and take on this lab yourself, head over the the Web Security Academy now #requestsmuggling #pentesting #bugbounty #hacking #cybersecurity

Web Security Academy

26,242 views • 1 year ago

.Anthropic will support stateless remote MCP servers with “just HTTP” as transport. We’re quite excited about this! So we gave a “lightning talk” at an MCP meetup hosted by Paul Butler Cloudflare Developers yesterday.

.Anthropic will support stateless remote MCP servers with “just HTTP” as transport. We’re quite excited about this! So we gave a “lightning talk” at an MCP meetup hosted by Paul Butler Cloudflare Developers yesterday.

OpenTools

100,980 views • 1 year ago

This is why we need to reevaluate the public assistance programs in this country. SNAP is supposed to be for ppl down on their luck who just need a lil help back on their feet, it’s not supposed to be a lifestyle.

This is why we need to reevaluate the public assistance programs in this country. SNAP is supposed to be for ppl down on their luck who just need a lil help back on their feet, it’s not supposed to be a lifestyle.

Libs Of Chicago

16,258 views • 1 year ago

Earns $400 per hour by listening to music. I've created a guide with 20 methods to help you earn $5,000 daily just by tuning in. Normally $199, but today, it's free. To get it: Like this post & RT Comment 'Music' I'll DM it to you (Must be following me)

Earns $400 per hour by listening to music. I've created a guide with 20 methods to help you earn $5,000 daily just by tuning in. Normally $199, but today, it's free. To get it: Like this post & RT Comment 'Music' I'll DM it to you (Must be following me)

George Amit | AI tools and Content Creator

66,947 views • 1 year ago

This woman stops to help this being on a rainy day on the highway. She isn't sure that this woman comes to her aid & hesitates. Some hands reach out for kindness, & some hesitate until feeling it. Thank you, kind people.

This woman stops to help this being on a rainy day on the highway. She isn't sure that this woman comes to her aid & hesitates. Some hands reach out for kindness, & some hesitate until feeling it. Thank you, kind people.

Hakan Kapucu

168,604 views • 9 months ago

Here's how to deliver reflected XSS through a HTTP request smuggling vulnerability! 👇 Try this Practitioner lab now:

Here's how to deliver reflected XSS through a HTTP request smuggling vulnerability! 👇 Try this Practitioner lab now:

Web Security Academy

45,999 views • 2 months ago

Here's a preview of what I've been working on with the Girl Front score to see if you like it. It's pretty simple at first (except for the arpeggios in the intro 😭), but it's supposed to get more difficult as it goes along.

Here's a preview of what I've been working on with the Girl Front score to see if you like it. It's pretty simple at first (except for the arpeggios in the intro 😭), but it's supposed to get more difficult as it goes along.

Xiomi♮

34,405 views • 4 months ago

Using a specific setup in Super Mario Maker 2, it is possible to create a "Negative Space Koopa Troopa". It will not only be invisible, but make objects behind it invisible as well, appearing as a walking hole in reality.

Using a specific setup in Super Mario Maker 2, it is possible to create a "Negative Space Koopa Troopa". It will not only be invisible, but make objects behind it invisible as well, appearing as a walking hole in reality.

Supper Mario Broth

119,280 views • 8 months ago

Anybody fancy a Cuppa? I've built a free tool to generate SEO-optimized blog posts in the time it takes to finish your morning brew. You can use it to: - Generate first drafts - Create guest post content - Enhance existing posts - Test AI content quickly Here's a video demo:

Anybody fancy a Cuppa? I've built a free tool to generate SEO-optimized blog posts in the time it takes to finish your morning brew. You can use it to: - Generate first drafts - Create guest post content - Enhance existing posts - Test AI content quickly Here's a video demo:

Ian Nuttall

53,744 views • 3 years ago

Cross-Progression is coming, here's a step-by-step guide to help you set it up on July 22nd! You can get ahead by creating your BHVR account and linking your platform accounts today, but you will only be able to merge progress next Monday. 🔗

Cross-Progression is coming, here's a step-by-step guide to help you set it up on July 22nd! You can get ahead by creating your BHVR account and linking your platform accounts today, but you will only be able to merge progress next Monday. 🔗

Dead by Daylight

678,149 views • 1 year ago

I've noticed not many are aware of it but I published a full guide on how to get started in web app security (& bug bounty) Instead of buying someone's course that just started out yesterday, you can use this for free It's sometimes much better, just take a look 👇

I've noticed not many are aware of it but I published a full guide on how to get started in web app security (& bug bounty) Instead of buying someone's course that just started out yesterday, you can use this for free It's sometimes much better, just take a look 👇

0xblackbird

40,858 views • 2 years ago

Sliver C2 developers have recently implemented an "external builder" feature to compile implants on external servers, but why not just use it to create completely custom implants instead? 🙃

Sliver C2 developers have recently implemented an "external builder" feature to compile implants on external servers, but why not just use it to create completely custom implants instead? 🙃

szymex73

18,510 views • 3 years ago

a liveplay comparison using the exploit described here Just to show how much of an advantage this can be first video is a liveplay using the exploit, second video is the replay from the first video without any changes to contrast or gamma. recorded by Teppi Fangirl (tarax)

a liveplay comparison using the exploit described here Just to show how much of an advantage this can be first video is a liveplay using the exploit, second video is the replay from the first video without any changes to contrast or gamma. recorded by Teppi Fangirl (tarax)

plasma

22,778 views • 9 months ago

Telling someone you’re trans is a personal thing & there’s more to me than that.. If I like you I’ll tell you on the first date so I’m not wasting your time: as I know some guys have a preference & that’s okay. But also, due to how some guys react sometimes I do it after by txt

Telling someone you’re trans is a personal thing & there’s more to me than that.. If I like you I’ll tell you on the first date so I’m not wasting your time: as I know some guys have a preference & that’s okay. But also, due to how some guys react sometimes I do it after by txt

Cassie

345,435 views • 2 years ago