Collected research

Gudifu: Guided Differential Fuzzing for HTTP Request Parsing Discrepancies

Bahruz Jabiyev, Anthony Gavazzi, Kaan Onarlioglu and Engin Kirda · raid2024.github.io

Chains of reverse proxies, caches and API gateways each parse an HTTP request, and small disagreements between them enable request smuggling and cache poisoning. This paper presents Gudifu, a graybox differential fuzzer that uses coverage feedback to probe proxy parsing behaviour and searches the entire request rather than one component. It finds more discrepancies than prior blackbox fuzzers and derives working access-control bypass, cache poisoning and smuggling attacks.

Record

Researcher

Bahruz Jabiyev, Anthony Gavazzi, Kaan Onarlioglu and Engin Kirda

Published by

raid2024.github.io

Format

Whitepaper

Topic

HTTP

In the archive

• Collected in the 2024 research round

Tags

• fuzzing
• parser-differential
• request-smuggling
• cache-poisoning
• reverse-proxy
• http
• auth-bypass
• owasp-a01-2021

This page is the archive's own catalogue record. The research is the work of Bahruz Jabiyev, Anthony Gavazzi, Kaan Onarlioglu and Engin Kirda, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 14 August 2026.