HTTP Request Smuggling in 2020 - New Variants, New Defenses and New Challenges

This course examines HTTP request smuggling attacks caused by differing interpretations of HTTP streams across proxies and web servers. It covers cache poisoning, WAF bypasses, newer variants, and a proof-of-concept defense using strict validation and socket-layer monitoring.

Syllabus

Intro
What is HTTP Request Smuggling?
Different interpretations of the TCP stream
A Short History
Is HTTP request Smuggling Still a Thing?
"Header SP/CR junk"
"Wait for it"
HTTP/1.2 to bypass CRS
Variant 3 (contd.)
A Plain Solution
CR Header
Overriding existing cache items
Flawed Approach #1
mod_security + CRS?
A different concept
A More Robust Approach
Design goals
Function Hooking
Socket Abstraction Layer (SAL)
SAL - What to Hook? (Windows)
SAL - What to Hook (Linux 64bit)
Challenges and Lessons Learned
Request Smuggling Firewall (RSFW)
New Research Challenges
CR in a header name is a hyphen
"Signed"Content-Length
Content-Length value with SP
Chunky Monkey Business