HTTP Request Smuggling Attack Explained // Untangling the HTTP Desync Attack

No video

HTTP Request Smuggling Attack Explained // Untangling the HTTP Desync Attack

Рет қаралды 13,881

securityguideme

Күн бұрын

Пікірлер: 34

@securityguideme 2 жыл бұрын

Do you have any feedback? Which vulnerabilities would you like me to explain in my next videos?

@sarmedwahab7288 2 жыл бұрын

lfi

@matthewzamat3331 2 жыл бұрын

This was by far the most informative and "complex but simple" approach to explaining this topic I have come across. You are a great teacher my friend. Thank you!

@sarmedwahab7288 2 жыл бұрын

The best explanation in terms of the exploitation, thanks a lot.

@securityguideme 2 жыл бұрын

Thank you!! Very glad you liked it!

@paweakomski6186 2 жыл бұрын

This is the best explanation of http request smiggling I've ever seen! Great job!

@paweakomski6186 2 жыл бұрын

When you show TE/CL, the second chunk is 23, not 0 - so far so good. But since 23 is one character longer than 0, the header Content-Length should be changed from 10 to 11.

@asaad0x 2 жыл бұрын

It's been 3 hours of seeing videos about HTTP request smuggling and still didn't get it. But when I see yours wow ! That was smooth and easy to understand ! Thanks for the content and now I'm Subscriber to your channel. Keep it up man

@mamadouourybah572 2 жыл бұрын

Nice explanations. I really like the exemple with the restaurant.

@securityguideme 2 жыл бұрын

Thank you :-)

@JuanBotes Жыл бұрын

Really great and easy understandable explanation of smuggling requests - thanks \o/

@spectre8 2 жыл бұрын

I had some difficulties to get my head around http request smuggling. But you delivered a great mnemonic. I will associate Pizza ristorante with request smuggling forever.

@securityguideme 2 жыл бұрын

Great! Glad it helped!

@danielmcpherson9062 Жыл бұрын

Amazing video! Thank you for making it! Quick question, at 17:14, you set the Content-Length to 800. If the victim's request isn't that long, wouldn't that result in the smuggled request being timed-out? Thanks again 🙏

@ArindamKashyap-qk1ps Жыл бұрын

Nice explanation bro. Can you please explain the vulnerability insecure java and php deserialization?

@seif9923 Жыл бұрын

thank you aaron

@mynd5196 2 жыл бұрын

That is awesome, thanks for taking the time. Kudos for the artistic talent as well ;) !

@sveneFX 11 ай бұрын

Now I got it, great explanation!

@g3nz0d 2 жыл бұрын

Surprisingly good explanation.

@securityguideme 2 жыл бұрын

Glad you liked it

@kerbalette156 Жыл бұрын

Awesome explanation and demo

@PinkDraconian 2 жыл бұрын

Great video!

@securityguideme 2 жыл бұрын

Thanks!

@phillawrence9741 2 жыл бұрын

The request body where the robot.txt is found can I still modify the supposed request to smuggle from there immediately rather than smuggling the robot.txt????

@mizo7627 2 жыл бұрын

Hey , probably best explanation on request smuggling, Thanks! However can you please clarify to me the use of "7f" in the request? And the 1 Z Q Any help is appreciated

@securityguideme 2 жыл бұрын

Thank's for your feedback! When requests are sent with "Transfer-Encoding: chunked", we need to specify how many bytes we are sent like... 4 (--> 4 bytes are following) id=1 (--> this is our payload and has 4 bytes) 0 (--> zero bytes follow. This is the end of our request) In your second example, we defined an INVALID request to force a server into a timeout. 1 (--> 1 byte is following) Z (--> our payload. Could be anything else like A, B, C, D, 1, 2, 3, 4, etc) Q (--> here we would expect the next chunk length. So the request is INVALID, at least for chunked requests; this could be any other letter like A, B, C, D, etc) The chunk lengths are defined as hexadecimal numbers. 7f in your first example is 127 in decimal (see: coolconversion.com/math/binary-octal-hexa-decimal/_hex__7F_to_decimal_), this means 127 bytes follow. The payload then actually has a length of 127 bytes and the 0 in the next line means: chunked payload ends here.

@mizo7627 2 жыл бұрын

Thank you so much for the response! Can we reject inserting the /r/n after some headers simply by escaping 1 line ?

@securityguideme 2 жыл бұрын

@@mizo7627 I'm not sure I understand what you mean. But you will probably not be able to replace carriage return/newline because this is part of the http standard. You might want to give an example, what payload you are referring to and what you want to reach by replacing the characters.

@mizo7627 2 жыл бұрын

I think it's more clear now, Thanks for the response and hope to see more videos from you!

@ameyk9038 2 жыл бұрын

very nice explanations thanks a lot but I am a defender and what is the way to prevent this attack ? any idea , can you point me to that ?

@securityguideme 2 жыл бұрын

Make sure your applications and web servers are all up to date. If you implement your own webservers... wait... do not implement your own web servers.

@user-eq9uv2fs7x 5 ай бұрын

bro how are you even writing?

@xoro163 2 жыл бұрын

GET /admin HTTP/1.1 foo: xGET / HTTP/1.1 host: innocent.com cookie:.... bro plz tell me how the server reads the second line(ie,foo:xGET..)? or it just ignore the line??