The Single-Packet Shovel: Digging For Desync-Powered Request Tunnelling

No ratings

Presented at Bsides Exeter 2025 by

Thomas Stacey

Despite HTTP Request Tunnelling's resurgence in recent years with the advent of [HTTP/2 Desync Attacks](https://portswigger.net/research/http2#h2desync), its much bolder big brother HTTP Request Smuggling has stolen the limelight, leaving cases of desync-powered tunnelling buried for all but the most dedicated tunnelling enthusiasts. In this session I will reveal the discovery of wide-spread cases of request tunnelling in applications powered by popular servers including IIS, Azure Front Door and `redacted` including the creation of a novel detection technique that combined the recently popularised "Single-Packet Attack" with our ever-trusty HTTP desync techniques. Throughout the presentation I will also explore the complexities of navigating security research for the first time, drawing parallels from the advice given in [so you want to be a web security researcher](https://portswigger.net/research/so-you-want-to-be-a-web-security-researcher) and illuminate the ease through which existing tooling from industry leading researchers can be adapted in order to rapidly test your own ideas even with a rudimentary understanding of programming.