CVE-2025-55315

CVE-2025-55315 Proof-of-concept Exploit für CVE-2025-55315 .NET HTTP Request Smuggling. Zeigt, wie fehlerhaft geparste Chunked-Encoding es Angreifern ermöglicht, Requests an Proxys und Load Balancern in verwundbaren ASP.NET Core/Kestrel-Servern vorbeizuschmuggeln. 📊 Präsentation Interaktive...

request_smuggler

Request smuggler Scanner di vulnerabilità di request smuggling HTTP Basato sull'incredibile ricerca di James Kettle. Lo strumento può aiutare a trovare server che potrebbero essere vulnerabili alla vulnerabilità di request smuggling. Archiviato...

CVE-2019-20372

REFERENZ https://bertjwregeer.keybase.pub/2019-12-10%20-%20errorpage%20request%20smuggling.pdf Server starten docker run -it --rm -p 80:80 -v pwd/default.conf:/etc/nginx/conf.d/default.conf nginx:1.17.6 Exploit printf "GET /a HTTP/1.1\r\nHost: localhost\r\nContent-Length: 56\r\n\r\nGET...

Security Bulletin: Security Vulnerability in Spring Cloud Affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2025-41235)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed the security vulnerability in Spring Cloud Vulnerability Details CVEID:CVE-2025-41235 DESCRIPTION: Spring Cloud Gateway Server forwards the X-Forwarded-For and Forwarded headers from untrusted proxies. CWE:CWE-444:...

crlf-powered-desync-scanner

Scanner di Desync Basato su CRLF Questa è l'estensione Burp che abbiamo utilizzato per rilevare tutti i casi della nostra ricerca CRLF-Powered Desync Attacks: Beheading HTTP Streams. È uno scanner pensato principalmente per la ricerca, costruito usando BulkScan, simile a HTTP Request Smuggler e...

CVE-2023-25690

CVE-2023-25690 Beschreibung von CVE-2023-25690: Einige modproxy-Konfigurationen auf dem Apache HTTP Server von Version 2.4.0 bis 2.4.55 ermöglichen HTTP-Request-Smuggling-Angriffe eine Angriffstechnik, die in den Prozess eingreift, mit dem eine Website die von einem oder mehreren Benutzern...

SAP-memory-pipes-desynchronization-vulnerability-MPI-CVE-2022-22536

SAP-memory-pipes-desynchronization-vulnerability-MPI-CVE-2022-22536 Di cosa tratta la vulnerabilità? SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 e SAP Web Dispatcher sono vulnerabili a request smuggling e concatenazione dell...

CVE-2024-40725

Strumento di Rilevamento di HTTP Request Smuggling Questo repository contiene uno strumento basato su Python per rilevare vulnerabilità di HTTP Request Smuggling, mirato specificamente a CVE-2024-40725. Lo strumento tenta di sfruttare questa vulnerabilità nel server HTTP Apache inviando richieste...

nodejs-http-transfer-encoding-smuggling-poc

nodejs-http-transfer-encoding-smuggling-poc PoC von HTTP Request Smuggling in Node.js CVE-2020-8287 src/index.js root@kitploit: header: 'Host', '127.0.0.1', 'Transfer-Encoding', 'chunked', 'Transfer-Encoding', 'eee' , body: 'A' header: 'Host', '127.0.0.1' , body: '' data: 'HTTP/1.1 200 OK\r\n' +...

echteeteepee

HTTP/1 Desync भेद्यता परीक्षण उपकरण इस रिपॉजिटरी में PortSwigger के James Kettle के अभूतपूर्व शोध पर आधारित HTTP/1 अनुरोध तस्करी desync भेद्यताओं का पता लगाने के लिए रक्षात्मक सुरक्षा उपकरण शामिल हैं। शोध श्रेय यह कार्य सीधे तौर पर निम्नलिखित तकनीकों से प्रेरित है और उन्हें लागू करता है: "HTTP/1...

CVE-2019-20372

Poc für CVE 2019-20372 [email protected] Beschreibung NGINX vor Version 1.17.7 ermöglicht bei bestimmten errorpage-Konfigurationen HTTP-Request-Smuggling, wie durch die Fähigkeit eines Angreifers demonstriert, nicht autorisierte Webseiten in Umgebungen zu lesen, in denen NGINX hinter einem...

CVE-2020-25613

प्रमाण root@kitploit: POST / HTTP/1.1 Host: 127.0.0.1:1080 Content-Type: text/html Content-Length: 129 Connection: keep-alive Transfer-Encoding: 0xb chunked 1 A 0 POST /flag HTTP/1.1 Host: 127.0.0.1:1080 Content-Length: 180 Connection: keep-alive Content-Type: text/html URI:...

CVE-2022-45059-demo

CVE-2022-45059-Demo Die Varnish-Cache-Versionen 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.1.0, 7.1.1 und 7.2.0 weisen eine Request-Smuggling-Schwachstelle auf, bei der ein Angreifer erreichen kann, dass der Content-Length-Header als Hop-by-Hop-Header behandelt wird. Dies ist eine Demo bestehend aus einer...

CVE-2026-71324

A flaw was found in Traefik. Traefik's HTTP reverse proxy can improperly handle HTTP/2 or HTTP/3 CONNECT requests forwarded to an HTTP/1.1 upstream. If the upstream sends a keep-alive non-2xx response and does not fully drain the body, the desynchronized backend socket is returned to a shared poo...

CVE-2026-73051

A flaw was found in actix-http. This vulnerability allows unauthenticated remote attackers to perform HTTP request smuggling. By sending specially crafted HTTP/1.1 requests that include both Content-Length and Transfer-Encoding: chunked headers, an attacker can desynchronize backend requests...

CVE-2026-74848

Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in Apache APISIX. An attacker could make other clients receive attacker-chosen or other users' responses on serverless-plugin routes. This issue affects Apache APISIX: from 2.12.0 through 3.17.0. Users ar...

audit-axios

audit-axios Scansiona i repository locali per versioni vulnerabili di axios e applica patch in modo interattivo. Prende di mira CVE-2026-40175 — Iniezione di intestazioni CRLF che porta a Request Smuggling e SSRF. CVSS 9.9, colpisce tutte le versioni di axios 1.15.0. Avvio Rapido root@kitploit: n...

EUVD-2026-66958

Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in Apache APISIX. An attacker could make other clients receive attacker-chosen or other users' responses on serverless-plugin routes. This issue affects Apache APISIX: from 2.12.0 through 3.17.0. Users ar...

CVE-2026-33555

Bypass della Validazione del Body FIN Standalone in HAProxy H3/QUIC tramite HTTP Request Smuggling Post completo qui : https://r3verii.github.io/cve/2026/04/14/haproxy-h3-standalone-fin-smuggling.html Riepilogo Una vulnerabilità nell'implementazione HTTP/3 di HAProxy consente a un attaccante di...

CVE-2025-55315-Scanner-Monitor

Scanner di Vulnerabilità CVE-2025-55315 e Proxy TLS Questo repository contiene strumenti per rilevare e monitorare applicazioni ASP.NET Core vulnerabili a CVE-2025-55315, che comporta lo smuggling di richieste HTTP a causa di header HTTP contrastanti. Strumenti Inclusi 1. Scanner di Vulnerabilità...