Collected research

T-Reqs: HTTP Request Smuggling with Differential Fuzzing

Bahruz Jabiyev, Steven Sprecher, Kaan Onarlioglu and Engin Kirda · bahruz.me

A grammar-based differential fuzzer generates HTTP requests and mutates the request line, headers and body, then compares how ten servers, proxies and CDNs parse each one to find pairs that disagree on where a message ends. Those disagreements let an attacker smuggle a hidden second request past the front server, enabling cache poisoning, request hijacking and control bypass.

Record

Researcher

Bahruz Jabiyev, Steven Sprecher, Kaan Onarlioglu and Engin Kirda

Published by

bahruz.me

Format

Whitepaper

Topic

HTTP

In the archive

• Collected in the 2021 research round

Tags

• request-smuggling
• desync
• parser-differential
• fuzzing
• http
• proxy
• cdn
• cache-poisoning
• tooling
• measurement-study

This page is the archive's own catalogue record. The research is the work of Bahruz Jabiyev, Steven Sprecher, Kaan Onarlioglu and Engin Kirda, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 11 August 2026.