Hey everyone! Check out this playlist for all my solutions to the HTTP Request Smuggling labs from PortSwigger - 👀 kzitem.info/door/PLGb2cDlBWRUX1_7RAIjRkZDYgAB3VbUSw Here are the timestamps for this video - ⏱ 00:00 - Intro 00:19 - Detect client-side desync with Burp 02:59 - Confirm client-Side desync in Burp with a differential response 05:21 - Confirm client-side desync in the Browser 09:39 - Find a vulnerable gadget to store our victim's request 12:54 - Confirm the vulnerable gadget in the browser 15:52 - Deliver the exploit to our victim 17:26 - Solve the lab by using our victim's leaked session cookie
@DaenerysTargaryen-mo1xr
10 күн бұрын
I found desync on a site that uses http 1.1 and it redirects to https 2.0 site , can this be exploited, is it a bug ?
@light_Tech01
8 ай бұрын
thanks so much❤❤
@netletic
8 ай бұрын
thank you @TechDroos! ❤️
@suprajabaskaran4948
7 ай бұрын
When I hit the send request in single connection, as mentioned in the video, the response is triggered for the first HTTP method only - which is the POST request. I do not get 404 instead a 200 OK which is the usual response
@netletic
6 ай бұрын
hey @suprajabaskaran4948, the attack request will get a 200 OK but the normal request should get a 404. Also make sure that the attack request has Connection: Keep-Alive set and that it's active, i.e. not underlined in Burp by enabling HTTP/1 connection reuse.
@user-yf7ob7fl6f
7 ай бұрын
I'm a bit confused about the differences between a client-side desync and a CL.0 attack. Can you explain the distinction between these two?
@coindescracks
7 ай бұрын
CL.0 request smuggling manipulates Content-Length headers to create discrepancies between front-end and back-end systems, potentially leading to unauthorized access. Client-side desynchronization attacks exploit inconsistencies in how browsers handle asynchronous communication, manipulating client-side code to achieve unauthorized actions or data exposure. The former targets communication channels, while the latter focuses on client-side execution in web applications.
@netletic
6 ай бұрын
hey @user-yf7ob7fl6f, to add onto @supakingbeatz's explanation, a CL.0 attacks desyncs the connection between a frontend and backend. A CSD attack desyncs the connection between a client's browser and the target website.
@jaywandery9269
4 ай бұрын
@@netletic well put
@calvinng7279
5 ай бұрын
Hey, great video, I learned alot from here! But can you please explain what is the purpose of the exploit server? I dont understand why it need to store the payload and send to victim.
@cowid
16 күн бұрын
The exploit server containts the malicious JS. Upon visiting the exploit server, the victim's browser triggers the malicious JS. So the exploit server provides a delivery mechanism.
Пікірлер: 12