HTTP/1.1 must die the desync endgame

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://portswigger.net/research/http1-must-die
• Blog Title: HTTP/1.1 must die: the desync endgame
• Suggested Section: Generic Hacking -> HTTP Request Smuggling

🎯 Content Summary

HTTP Request Smuggling Summary

HTTP/1.1 concatenates requests on a shared TCP/TLS connection without explicit delimiters and supports four length indicators: Content-Length (CL), Transfer-Encoding (TE), implicit-zero (0) and HTTP/2 framing (H2). In reverse-proxy chains, minute parser discrepancies between front-end and back-end yield desynchronization, enabling malicious request smuggling that can trigger cache poisoning, header inj...

🔧 Technical Details

Parser discrepancy detection leverages sending masked or malformed headers (e.g. leading-space or duplicate invalid header names) to observe distinct front-end and back-end status codes, revealing Visible-Hidden or Hidden-Visible parsing mismatches that enable smuggling.

CL.0 and TE.CL primitives exploit length ambiguity by obfuscating the Content-Length or Transfer-Encoding header, respectively, causing one parser to ignore the header and treat the smuggled request as body.

🤖 Agent Actions

An unexpected error occurred while updating the HTTP Request Smuggling page and the original content integrity might have been affected. No new techniques have been safely added yet. I’m stopping here to avoid introducing inconsistencies.

✅ Review Checklist

• Content is technically accurate
• Formatting follows HackTricks style guidelines
• Links and references are working
• Content adds educational value
• No sensitive information is exposed

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

📚 Repository Maintenance

• MD files processed: 865
• MD files fixed: 1

All .md files have been checked for proper formatting (headers, includes, etc.).

[carlospolop]

🔗 Additional Context

Original Blog Post: https://portswigger.net/research/http1-must-die

Content Categories: Based on the analysis, this content was categorized under "Generic Hacking -> HTTP Request Smuggling".

Repository Maintenance:

• MD Files Formatting: 865 files processed (1 files fixed)

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0