Collected research
Cracking the Lens: Targeting HTTP's Hidden Attack-Surface
Cracking the lens: targeting HTTP's hidden attack-surface
Malformed Host headers and esoteric request headers make reverse proxies and other transparent intermediaries reveal themselves and misroute requests into internal networks. The same tricks reach intercepting middleboxes and caching proxies, yielding server-side request forgery, internal service access and poisoned caches at bug bounty scale.
Record
- Document
- Cracking the lens: targeting HTTP's hidden attack-surface
- Researcher
- James Kettle
- Published by
- PortSwigger Research
- Date
- Topic
- HTTP
In the archive
Related sources
- Collaborator Everywhere
- Rendering Engine Hackability Probe
- How I accidentally framed myself for a hacking frenzy
- Finding that one weird endpoint, with Bambdas
- Cracking the Lens: Targeting HTTP's Hidden Attack-Surface
Tags
This page is the archive's own catalogue record. The research is the work of James Kettle, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .