The Silent Danger in HTTP: Identifying HTTP Desync Vulnerabilities with Gray-box Testing
No ratings
Presented at USENIX Security 2025 by
HTTP Desync is a high-risk threat in today's decentralized Internet, stemming from discrepancies among HTTP implementations. Current automatic detection tools, primarily dictionary-based scanners and black-box fuzzers, lack insights into internal states of implementations, leading to ineffective testing. Moreover, they focus on the request-side Desync, overlooking vulnerabilities in HTTP responses.