Top 10 winner

Exploiting HTTP Parsers Inconsistencies

(Research) Exploiting HTTP Parsers Inconsistencies

Rafael da Costa Santos · Rafa's Security Researches · 17 June 2023

A survey of parsing disagreements between proxies and backends. Characters that Node.js, Flask and Spring strip from a request path but Nginx keeps let an attacker slip past location-based ACLs. Header line folding hides a payload from AWS WAF while the backend still reads it as a header value. Paths beginning with @, semicolon or asterisk turn naive URL concatenation in proxy code into SSRF, and header-name bytes that S3 ignores but caches do not allow cache poisoning.

Record

Document

(Research) Exploiting HTTP Parsers Inconsistencies

Researcher

Rafael da Costa Santos

Published by

Rafa's Security Researches

Date

17 June 2023

Topic

HTTP

In the archive

• Ranked #5 in the 2023 Top 10 Web Hacking Techniques

Tags

• parser-differential
• waf-bypass
• ssrf
• cache-poisoning
• desync
• url-parsing
• http
• reverse-proxy
• aws
• owasp-a05-2021
• owasp-a10-2021

This page is the archive's own catalogue record. The research is the work of Rafael da Costa Santos, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 9 August 2026.