proxy-bypass

Main Stage·42 min

• DEF CON
• AppSec
• Date: Aug 2019
• Location: Las Vegas

James Kettle

Presents HTTP request smuggling as a modern attack primitive for cache poisoning, session hijacking, and WAF bypass.

Main Stage·36 min

• DEF CON
• AppSec
• Date: Aug 2016
• Location: Las Vegas

regilero

regilero demystifies HTTP request smuggling techniques, illustrating how desynchronizing reverse proxies and backend web servers leads to cache poisoning and filter bypasses.

Main Stage·45 min

• DEF CON
• AppSec
• Date: Aug 2016
• Location: Las Vegas

Alex Chapman · Paul Stone

Alex Chapman and Paul Stone unveil vulnerabilities in Web Proxy Auto-Discovery (WPAD), demonstrating forced proxy hijacking and HTTPS interception across major browsers.