HTTP request smuggling

Chaim Linhart; Amit Klein; Ronen Heled; Steve Orrin

HTTP request smuggling

Chaim Linhart, Amit Klein, Ronen Heled, Steve Orrin

The Rachel and Selim Benin School of Engineering and Computer Science

Research output: Contribution to specialist publication › Article

3 Scopus citations

Abstract

A new hacking technique HTTP request smuggling (HRS) and the damages that it can inflict, are discussed. HRS send multiple HTTP requests that cause two attacked devices to see different sets of requests, allowing the hacker to smuggle a request to one device without the other device being aware of it. The attacker can change the entries in the cache, so that an existing page would be cached under another page. It is also possible to exploit a vulnerability in the Web application to steal client credentials without the need to actually contact the client.

Original language	English
Pages	13-26
Number of pages	14
Volume	22
No	1
Specialist publication	Computer Security Journal
State	Published - Dec 2006

Cite this

@misc{933126520e214c7faaf7e6717e487465,

title = "HTTP request smuggling",

abstract = "A new hacking technique HTTP request smuggling (HRS) and the damages that it can inflict, are discussed. HRS send multiple HTTP requests that cause two attacked devices to see different sets of requests, allowing the hacker to smuggle a request to one device without the other device being aware of it. The attacker can change the entries in the cache, so that an existing page would be cached under another page. It is also possible to exploit a vulnerability in the Web application to steal client credentials without the need to actually contact the client.",

author = "Chaim Linhart and Amit Klein and Ronen Heled and Steve Orrin",

year = "2006",

month = dec,

language = "אנגלית",

volume = "22",

pages = "13--26",

journal = "Computer Security Journal",

issn = "0277-0865",

publisher = "Computer Security Institute",

}

TY - GEN

T1 - HTTP request smuggling

AU - Linhart, Chaim

AU - Klein, Amit

AU - Heled, Ronen

AU - Orrin, Steve

PY - 2006/12

Y1 - 2006/12

N2 - A new hacking technique HTTP request smuggling (HRS) and the damages that it can inflict, are discussed. HRS send multiple HTTP requests that cause two attacked devices to see different sets of requests, allowing the hacker to smuggle a request to one device without the other device being aware of it. The attacker can change the entries in the cache, so that an existing page would be cached under another page. It is also possible to exploit a vulnerability in the Web application to steal client credentials without the need to actually contact the client.

AB - A new hacking technique HTTP request smuggling (HRS) and the damages that it can inflict, are discussed. HRS send multiple HTTP requests that cause two attacked devices to see different sets of requests, allowing the hacker to smuggle a request to one device without the other device being aware of it. The attacker can change the entries in the cache, so that an existing page would be cached under another page. It is also possible to exploit a vulnerability in the Web application to steal client credentials without the need to actually contact the client.

UR - http://www.scopus.com/inward/record.url?scp=33644879212&partnerID=8YFLogxK

M3 - מאמר בכתב עת

AN - SCOPUS:33644879212

SN - 0277-0865

VL - 22

SP - 13

EP - 26

JO - Computer Security Journal

JF - Computer Security Journal

ER -

HTTP request smuggling

Abstract

Other files and links

Fingerprint

Cite this