Video yükleniyor...

Video Yüklenemedi

Bu video yüklenirken bir sorun oluştu. Bu geçici bir ağ sorunundan kaynaklanıyor olabilir veya video kullanılamıyor olabilir.

Ana Sayfaya Dön

What is HTTP Downgrading, why use it, and how does it work? HTTP/2 is default for most web apps these days, however, it's not uncommon for backend servers to still use HTTP/1.1 causing parsing mismatches between frontend and backend. And that's where HTTP downgrading comes in! But what is... it? HTTP downgrading is the process of forcing a request to be processed under HTTP/1.1 instead of HTTP/2. This allows you to manipulate how the frontend and backend servers interpret requests and exploit vulnerabilities unique to HTTP/1.1 parsing such as Content-Length Transfer-Encoding (CL.TE) attacks. How to downgrade HTTP/2 to HTTP/1.1 using Burp Suite 1️⃣ Open Burp Suite and Navigate to Proxy → HTTP History 2️⃣ Locate the request that is currently using HTTP/2. 3️⃣ Send the Request to Repeater 4️⃣ In the Repeater tab, open the "Inspector" panel → Request Attributes → Protocol 5️⃣ Change HTTP Version to HTTP/1.1 6️⃣ Click "Send" in Repeater. If successful, you should receive a valid response, confirming the server accepts HTTP/1.1. And that's it! You've just downgraded the HTTP protocol and confirmed that the frontend server accepts HTTP/1.1! 🥳 You are now ready to smuggle requests! If you want to learn how to exploit this, we've got a Web Academy Lab you need to check out: Thanks for reading! #requestsmuggling #cybersecurity #BurpSuite #hacking #infosecshow more

Web Security Academy

145,568 subscribers

62,870 görüntüleme • 1 yıl önce •via X (Twitter)

Eğitim Bilim & Teknoloji

Anya Rossi• Live Now

Private livecam show

6 Yorum

Jin profil fotoğrafı

Jin1 yıl önce

.

UserInterface profil fotoğrafı

UserInterface3 yıl önce

What is Web3? The Next Evolution of the Internet #tech #news

Priesthood emmanuel 🪔 profil fotoğrafı

Priesthood emmanuel 🪔1 yıl önce

@TweetHelperBot download this please

𐌌Ꝋᒍ𐌉𐌀 profil fotoğrafı

𐌌Ꝋᒍ𐌉𐌀1 yıl önce

Hmmmm , me : edit by my hands and delete HTTP/2 to HTTP/1.1 , please use your hands

Aman Hasan profil fotoğrafı

Aman Hasan1 yıl önce

very usefull :)

Ali Essam profil fotoğrafı

Ali Essam1 yıl önce

what is the impact?

Benzer Videolar

HTTP Request Smuggling Lab Walkthrough: Confirming a CL.TE vulnerability via differential responses. How to identify CLTE Vulnerabilities: 1. Send request to repeater 2. Downgrade protocol to HTTP/1.1 3. Disable "Update Content-Length" 4. Set Content-Length to 6 5. Add "Transfer-Encoding: chunked" heading 6. Send a chunk with an invalid chunk size If the backend times out, this indicates a potential CLTE vulnerability. Confirm the vulnerability with differential responses: 7. Create and send the attack request: - Replace previous chunk with a terminating chunk. - Add a smuggled request after the chunked body. - Append X-ignore: X (without a newline) and send. 8. Send a normal request to repeater, downgrade to HTTP/1.1 and send immediately after the attack request. If the response to the normal request is 404 instead of 200, the backend was poisoned! 🤮 Well done! To learn more about HTTP Request Smuggling and take on this lab yourself, head over the the Web Security Academy now #requestsmuggling #pentesting #bugbounty #hacking #cybersecurity

HTTP Request Smuggling Lab Walkthrough: Confirming a CL.TE vulnerability via differential responses. How to identify CLTE Vulnerabilities: 1. Send request to repeater 2. Downgrade protocol to HTTP/1.1 3. Disable "Update Content-Length" 4. Set Content-Length to 6 5. Add "Transfer-Encoding: chunked" heading 6. Send a chunk with an invalid chunk size If the backend times out, this indicates a potential CLTE vulnerability. Confirm the vulnerability with differential responses: 7. Create and send the attack request: - Replace previous chunk with a terminating chunk. - Add a smuggled request after the chunked body. - Append X-ignore: X (without a newline) and send. 8. Send a normal request to repeater, downgrade to HTTP/1.1 and send immediately after the attack request. If the response to the normal request is 404 instead of 200, the backend was poisoned! 🤮 Well done! To learn more about HTTP Request Smuggling and take on this lab yourself, head over the the Web Security Academy now #requestsmuggling #pentesting #bugbounty #hacking #cybersecurity

Web Security Academy

26,360 görüntüleme • 1 yıl önce

How to manually check for CL.TE Request Smuggling Vulnerabilities: 1️⃣ See if a GET request accepts POST 2️⃣ See if it accepts HTTP/1 3️⃣ Disable "Update Content-Length" 4️⃣ Send with CL & TE headers: POST / HTTP/1.1 Host: Content-Length: 6 Transfer-Encoding: chunked 0 G 5️⃣ Send request twice. If you receive a response like "Unrecognized method GPOST", you've just confirmed a CL.TE vulnerability! Try this out for yourself in our CL.TE lab:

How to manually check for CL.TE Request Smuggling Vulnerabilities: 1️⃣ See if a GET request accepts POST 2️⃣ See if it accepts HTTP/1 3️⃣ Disable "Update Content-Length" 4️⃣ Send with CL & TE headers: POST / HTTP/1.1 Host: Content-Length: 6 Transfer-Encoding: chunked 0 G 5️⃣ Send request twice. If you receive a response like "Unrecognized method GPOST", you've just confirmed a CL.TE vulnerability! Try this out for yourself in our CL.TE lab:

Web Security Academy

27,993 görüntüleme • 1 yıl önce

Want to find HTTP Request Smuggling vulns without manually crafting weird requests? Check out HTTP Request Smuggler, a Burp Suite extension that automates it for you! Learn more:

Want to find HTTP Request Smuggling vulns without manually crafting weird requests? Check out HTTP Request Smuggler, a Burp Suite extension that automates it for you! Learn more:

Web Security Academy

11,696 görüntüleme • 1 yıl önce

Built a C socket library that goes from raw TCP all the way up to gRPC over HTTP/3. No external dependencies for the core stack. HTTP/1.1/2/3, QUIC, WebSocket, TLS 1.3, DNSSEC, DEFLATE, io_uring, connection pooling. The only C library with native gRPC over HTTP/3.

Built a C socket library that goes from raw TCP all the way up to gRPC over HTTP/3. No external dependencies for the core stack. HTTP/1.1/2/3, QUIC, WebSocket, TLS 1.3, DNSSEC, DEFLATE, io_uring, connection pooling. The only C library with native gRPC over HTTP/3.

tetsuo

210,667 görüntüleme • 8 ay önce

Excerpt: HTTP/2 introduced streams - multiple streams of requests could be sent on one TCP connection. Independent streams solve head of line blocking issue vs HTTP/1.1 pipelining

Excerpt: HTTP/2 introduced streams - multiple streams of requests could be sent on one TCP connection. Independent streams solve head of line blocking issue vs HTTP/1.1 pipelining

Sahn Lam

19,313 görüntüleme • 2 yıl önce

Microsoft CTO Kevin Scott says MCP is becoming the HTTP of the agentic web. Like HTTP, it's lightweight, composable, and interoperable. Microsoft is betting on MCP as the backbone for agent communication, scale, and evolution.

Microsoft CTO Kevin Scott says MCP is becoming the HTTP of the agentic web. Like HTTP, it's lightweight, composable, and interoperable. Microsoft is betting on MCP as the backbone for agent communication, scale, and evolution.

vitrupo

115,935 görüntüleme • 1 yıl önce

AI Agent unlocking content behind a "HTTP 402 Payment Required" #Nano paywall. The payment address/amount to unlock is communicated by the paywall using HTTP headers, and the AI Agent uses its own Nano wallet to pay for and read the content. #AIAgents will use $XNO 🤖

AI Agent unlocking content behind a "HTTP 402 Payment Required" #Nano paywall. The payment address/amount to unlock is communicated by the paywall using HTTP headers, and the AI Agent uses its own Nano wallet to pay for and read the content. #AIAgents will use $XNO 🤖

NanoCharts Ӿ 📊

19,656 görüntüleme • 1 yıl önce

How to deliver reflected XSS via HTTP request smuggling vulnerability! 👇 Try this Practitioner lab now:

How to deliver reflected XSS via HTTP request smuggling vulnerability! 👇 Try this Practitioner lab now:

Web Security Academy

60,343 görüntüleme • 3 ay önce

#Roblox #RobloxDev Facial Unification is a non-HTTP module which converts Dynamic Faces to their classic 2D variants. It works without HTTP request, it's linked as a package so it will stay up-to-date with my manual changes. LINK:

#Roblox #RobloxDev Facial Unification is a non-HTTP module which converts Dynamic Faces to their classic 2D variants. It works without HTTP request, it's linked as a package so it will stay up-to-date with my manual changes. LINK:

Dogutsune

484,798 görüntüleme • 8 ay önce

HTTP is supposed to be stateless, but sometimes... it isn't! Some servers create invisible vulnerabilities by only validating the first request on each TCP/TLS connection. I've just published a Custom Action to help you detect & exploit this - here's a narrated demo:

HTTP is supposed to be stateless, but sometimes... it isn't! Some servers create invisible vulnerabilities by only validating the first request on each TCP/TLS connection. I've just published a Custom Action to help you detect & exploit this - here's a narrated demo:

James Kettle

140,249 görüntüleme • 1 yıl önce

💾 Vibe coded an entire dial-up TCP/IP stack for my TUI OS to get to the internet so it can now too browse the web It uses the same ISP as does which is (a real dial up provider) and then the browser routes you to my HTTP-proxy (because it doesn't support HTTPS yet) so you can open modern websites with it WebSocket → HDLC framing → PPP → LCP/EAP/IPCP → IPv4 → UDP → DNS (one round trip) → IPv4 → TCP (3-way handshake) → HTTP/1.0 → HTTP reverse proxy → HTML parse → render in OS browser -> render in your browser Also we have some techno in the music player now (not good yet) VERY GEEKY 🤓

💾 Vibe coded an entire dial-up TCP/IP stack for my TUI OS to get to the internet so it can now too browse the web It uses the same ISP as does which is (a real dial up provider) and then the browser routes you to my HTTP-proxy (because it doesn't support HTTPS yet) so you can open modern websites with it WebSocket → HDLC framing → PPP → LCP/EAP/IPCP → IPv4 → UDP → DNS (one round trip) → IPv4 → TCP (3-way handshake) → HTTP/1.0 → HTTP reverse proxy → HTML parse → render in OS browser -> render in your browser Also we have some techno in the music player now (not good yet) VERY GEEKY 🤓

@levelsio

130,889 görüntüleme • 6 ay önce

Supabase now provides a free easy-to-use corn job scheduler! Configure the job from the dashboard and set it to send an HTTP request or call a database or edge function periodically! View the history of the past jobs that it ran so that you can debug when something goes wrong!

Supabase now provides a free easy-to-use corn job scheduler! Configure the job from the dashboard and set it to send an HTTP request or call a database or edge function periodically! View the history of the past jobs that it ran so that you can debug when something goes wrong!

Tyler Shukert

24,247 görüntüleme • 1 yıl önce

Day 2 of learning Go after office hours More progress on HTTP server (with routes). This HTTP server will finally act as a gateway service that will serve client requests by calling the Raft Cluster (leader) deployed separately. Next stop: Goroutines, channels & concurrency

Day 2 of learning Go after office hours More progress on HTTP server (with routes). This HTTP server will finally act as a gateway service that will serve client requests by calling the Raft Cluster (leader) deployed separately. Next stop: Goroutines, channels & concurrency

avrl ☘

79,321 görüntüleme • 5 ay önce

$How to Find Path Delimiter Issues with Burp Suite Intruder Sometimes web servers treat special characters (like ; or ?) differently in URLs. This can lead to security issues like web cache deception or access control problems. Here's how you can test for path delimiter discrepancies: 1️⃣ Capture the Request Find a request you want to test GET /my-account HTTP/2 2️⃣ Right click the request and "Send to Intruder". In Intruder, highlight add a new position after /my-account followed by abc. It should look like this: GET /my-account§§abc HTTP/2 Attack Type = Sniper (only changing one spot). Payload: Paste a list of special characters, like this: ! # $ % & ' ( ) * + , - . / : ; = ? @ [ \ ] _ ~ ... A full list of delimiters can be found here: 3️⃣ Start the Attack Press Start Attack. Look at the Status, Length, and Response columns. Watch for differences (like bigger/smaller pages, changes to status code or different behavior) and if you notice something different then you've likely found a delimiter discrepancy! 🎉 Why is this important? When special characters confuse the server or cache, you might find: 🔸 Web cache deception: Caching personal pages by accident 🔸 Access bypass: Skipping security checks 🔸 Leaked info: Seeing data you shouldn't Try this lab for yourself and dive even deeper into how to exploit this when you find it: #BugBounty #WebSecurity #BurpSuite #EthicalHacking #Cybersecurity$

How to Find Path Delimiter Issues with Burp Suite Intruder Sometimes web servers treat special characters (like ; or ?) differently in URLs. This can lead to security issues like web cache deception or access control problems. Here's how you can test for path delimiter discrepancies: 1️⃣ Capture the Request Find a request you want to test GET /my-account HTTP/2 2️⃣ Right click the request and "Send to Intruder". In Intruder, highlight add a new position after /my-account followed by abc. It should look like this: GET /my-account§§abc HTTP/2 Attack Type = Sniper (only changing one spot). Payload: Paste a list of special characters, like this: ! # $ % & ' ( ) * + , - . / : ; = ? @ [ \ ] _ ~ ... A full list of delimiters can be found here: 3️⃣ Start the Attack Press Start Attack. Look at the Status, Length, and Response columns. Watch for differences (like bigger/smaller pages, changes to status code or different behavior) and if you notice something different then you've likely found a delimiter discrepancy! 🎉 Why is this important? When special characters confuse the server or cache, you might find: 🔸 Web cache deception: Caching personal pages by accident 🔸 Access bypass: Skipping security checks 🔸 Leaked info: Seeing data you shouldn't Try this lab for yourself and dive even deeper into how to exploit this when you find it: #BugBounty #WebSecurity #BurpSuite #EthicalHacking #Cybersecurity

Web Security Academy

18,220 görüntüleme • 1 yıl önce