Love web & AI security research? Want to do it full time on-site with myself, Gareth Heyes & Zak Fedotkin? Join the PortSwigger Research team - we're hiring!

https://apply.workable.com/portswigger/j/FC27ED6166/

I just published a Repeater feature to make it easier to explore request smuggling. It repeats your request until the status code changes. It's called "Retry until success" and you can install it via the Extensibility helper bapp.

Credit for the concept to whoever suggested it on the livestream last week! You can also load it simply by creating a Custom Action then copy+paste the code from here: https://github.com/PortSwigger/bambdas/blob/main/CustomAction/RetryUntilSuccess.bambda

Ever seen a header injection where achieving a desync seemed impossible? I think I've finally identified the cause - nginx doesn't reuse upstream connections by default, and often has header injection. This means you're left with a blind request tunneling vulnerability.

To try and achieve a desync refer to: https://portswigger.net/research/making-http-header-injection-critical-via-response-queue-poisoning

If you're stuck with tunneling, use: https://portswigger.net/web-security/request-smuggling/advanced/request-tunnelling