Collected research

HTTP Desync Attacks: Request Smuggling Reborn

James Kettle · PortSwigger Research · 7 August 2019

Revives HTTP request smuggling by making front-end and back-end servers disagree about where a request ends, using conflicting Content-Length and Transfer-Encoding headers hidden by parser quirks. Timing-based detection makes testing safe, and the poisoned socket lets an attacker prepend content to other users' requests, steal credentials, poison caches and reach internal endpoints.

Record

Researcher

James Kettle

Published by

PortSwigger Research

Date

7 August 2019

Topic

HTTP

In the archive

• Collected in the 2019 research round

Related sources

• Presentation slides Whitepaper
• Research extension
• HTTP request smuggling labs
• HTTP Desync Attacks: what happened next
• Breaking the chains on HTTP Request Smuggler
• HTTP Desync Attacks: Request Smuggling Reborn
• albinowax - HTTP Desync Attacks: Smashing into the Cell Next Door - DEF CON 27 Conference

Tags

• request-smuggling
• desync
• http
• reverse-proxy
• cdn
• cache-poisoning
• proxy
• bug-bounty

This page is the archive's own catalogue record. The research is the work of James Kettle, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 11 August 2026.