request-smuggling

Black Hat·48 min

• Black Hat
• Red Team
• Date: 2025
• Location: Black Hat

Security researchers examine technical aspects of HTTP Desync Attacks: Request Smuggling Reborn.

Black Hat·43 min

• Black Hat
• Community
• Date: 2025
• Location: Black Hat

New Variants · New Challenges

Engineers explore architecture and security mechanisms for HTTP Request Smuggling in 2020 - New Variants, New Defenses and New Challenges.

Ekoparty Security Conference·32 min

• EKOPARTY
• Blue Team
• Date: 2025
• Location: Ekoparty

Examines ekoparty #UniTalks Colombia | Anderson David Valencia: HTTP Request Smuggling and evaluates key implications for security practitioners.

Hack In The Box Security Conference (HITBSecConf)·40 min

• HITB
• Hardware
• Date: 2024
• Location: Hitb

Engineers explore architecture and security mechanisms for #HITB2024BKK D2 - Leveraging Request Smuggling For Authentication Bypass and Remote Code Execution.

NahamSec·21 min

• NAHAMSEC
• Red Team
• Date: 2022
• Location: Nahamsec

James Kettle)

HTTP Request Smuggling Explained (with James Kettle).

NahamSec·1 hr 4 min

• NAHAMSEC
• Red Team
• Date: 2022
• Location: Nahamsec

James Kettle (albinowax) Talks About Request Smuggling, Security Research, Hacking, and More!.

NahamSec·45 min

• NAHAMSEC
• Red Team
• Date: 2022
• Location: Nahamsec

Practical Attacks Using HTTP Request Smuggling by @defparam.

Main Stage·40 min

• DEF CON
• AppSec
• Date: Aug 2021
• Location: Las Vegas

James Kettle

PortSwigger researcher James Kettle pioneers HTTP/2 request smuggling, uncovering critical implementation flaws when front-end reverse proxies downgrade to back-end HTTP/1.1.

Main Stage·46 min

• DEF CON
• AppSec
• Date: Aug 2021
• Location: Las Vegas

Martin Doyhenard

Martin Doyhenard introduces HTTP Response Smuggling, exploiting desynchronization in HTTP/1.1 response pipelines to poison caches and hijack user sessions.

Main Stage·36 min

• DEF CON
• AppSec
• Date: Aug 2016
• Location: Las Vegas

regilero

regilero demystifies HTTP request smuggling techniques, illustrating how desynchronizing reverse proxies and backend web servers leads to cache poisoning and filter bypasses.