Amin Nasiri
@0xnxenon
Fan of reading RFCs and interested in playing with different versions of HTTP and web-related protocols & also inductive reasoning; a Hitchhiker when I am AFK
You might like
I have added some features to get time of the responses in nano seconds on h2spacex library and also enhanced Single Packet Attack method. Now you can exploit the timing attacks 🔥⏱️ github.com/nxenon/h2spacex
The whitepaper is live! Listen to the whispers: web timing attacks that actually work. Read it here -> portswigger.net/research/liste…
I'm thrilled to announce "HTTP/1 Must Die! The Desync Endgame" is coming to #DEFCON33! This talk will feature multiple new classes of desync attack, mass exploitation spanning multiple CDNs, and over $200k in bug bounties. See you there!
I have added application/grpc-web+proto support in my extension. Now you can encode/decode these content-types automatically: - application/grpc-web-text - application/grpc-web+proto github.com/nxenon/grpc-pe… #burp #burp_extension #grpc_web #grpc_web_pentest
I also have an account on Blue Sky, drop me a follow if you are there too bsky.app/profile/nxenon…
You can bypass path-based WAF restrictions by appending raw/unencoded non-printable and extended-ASCII characters like \x09 (Spring), \xA0 (Express), and \x1C-1F (Flask):
You can wrap @0xnxenon's h2xspacex library pretty quickly in python to perform timing-related SPA tests. Here's a scoped-SSRF detection using that detects DNS behavior changing between 60 and 70 chars of the host header as explained in @albinowax's presentation
I have added some features to get time of the responses in nano seconds on h2spacex library and also enhanced Single Packet Attack method. Now you can exploit the timing attacks 🔥⏱️ github.com/nxenon/h2spacex
The whitepaper is live! Listen to the whispers: web timing attacks that actually work. Read it here -> portswigger.net/research/liste…
I recently developed and posted about a technique called "First sequence sync", expanding @albinowax's single packet attack. This technique allowed me to send 10,000 requests in 166ms, which breaks the packet size limitation of the single packet attack. flatt.tech/research/posts…
I love the debate around storing JWTs in localStorage
When researching request smuggling, I decided that TE.0 would never be exploitable because it requires the back-end server to accept a HTTP request starting with a number + newline.... and no server would be that crazy 🤦♂️ Awesome work! Never under-estimate the crazy.
This is one of the most widespread and impactful bugs I've ever found in my career. Great collab with @bsysop and @_medusa_1_ Smugglings are still out there—stay vigilant! #bugbounty @Bugcrowd bugcrowd.com/blog/unveiling…
Lovely to see the Email RFCs abused to embed a command injection payload in the local-part of the address! Nice work Michael Imfeld & @parzel2 modzero.com/en/blog/beyond…
Does Burp have plan to support HTTP/3 and quic @albinowax @Burp_Suite ? I think many websites now use HTTP/3 and hackers also need to upgrade their tools to hack the applications using H3 too.
Turbo Intruder doesn't support the single-packet attack when run via the command line, since it leans on Burp Suite's network stack for HTTP/2 (I did code a native HTTP/2 stack for TI but it's really flaky). h2spacex is perfect for the standalone exploit use case.
Nice to know that UDP + (one protocol on it) can be as expensive as TCP (not from networking perspective), because of context switch between user space and the OS
For pentesting application/grpc-web+proto Content-Type see this short article: medium.com/@nxenon/hackin…
medium.com
Hacking into gRPC-Web : Part 2
Manipulating application/grpc-web+proto Content-Type
DOS in HTTP/2 implementations: According to my interest in HTTP/2 protocol and its attack like Rapid Reset Attack and Single Packet Attack, I would say that you have to read this too. Nice Job from Bartek.
The case I've been working in 2024.Q1: The CONTINUATION Flood is a class of vulnerabilities within numerous HTTP/2 protocol implementations. A single TCP connection can lead to server crash. Check the advisory at: nowotarski.info/http2-continua…
United States Trends
- 1. Jokic 25.6K posts
- 2. Lakers 52.7K posts
- 3. Epstein 1.67M posts
- 4. #AEWDynamite 50.2K posts
- 5. #River 5,046 posts
- 6. Nemec 3,339 posts
- 7. Clippers 14.5K posts
- 8. Shai 16.3K posts
- 9. #ReasonableDoubtHulu N/A
- 10. Thunder 40.9K posts
- 11. #NJDevils 3,114 posts
- 12. Markstrom 1,256 posts
- 13. #Blackhawks 1,602 posts
- 14. Ty Lue 1,146 posts
- 15. Nemo 8,582 posts
- 16. Mikey 71.8K posts
- 17. Lafferty N/A
- 18. Rory 8,055 posts
- 19. Joker 26.6K posts
- 20. Jordan Miller N/A
You might like
Something went wrong.
Something went wrong.