Top 10 winner

Browser-Powered Desync Attacks: A New Frontier in HTTP Request Smuggling

James Kettle · PortSwigger Research · 10 August 2022

A browser-issuable POST whose Content-Length the server ignores lets an attacker page desync the victim browser's own connection pool and prepend an arbitrary request, so request smuggling reaches single-server sites and intranets with no front-end. A second trigger, pause-based desync, exploits request timeouts in Varnish and Apache that leave half-read requests on a reusable connection.

Record

Researcher

James Kettle

Published by

PortSwigger Research

Date

10 August 2022

Topic

HTTP

In the archive

• Ranked #2 in the 2022 Top 10 Web Hacking Techniques

Related sources

• Presentation slides Whitepaper
• Research extension
• Research implementation
• DEF CON 30 - James Kettle - Browser-Powered Desync Attacks: A New Frontier in HTTP Request Smuggling
• Browser-Powered Desync Attacks: A New Frontier in HTTP Request Smuggling

Tags

• desync
• request-smuggling
• http
• cache-poisoning
• reverse-proxy
• cdn
• tooling

This page is the archive's own catalogue record. The research is the work of James Kettle, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 16 August 2026.