Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Difference bewteen HTTP Request Smuggler Extension and HTTP request smuggling with Burp scanner

Paolo | Last updated: Aug 13, 2024 05:03PM UTC

Hello, I am currently studying HTTP Desync Attacks and comparing the various tools used to test for these types of vulnerabilities. While experimenting with the HTTP Request Smuggler Extension and Burp Scanner (and also reviewing the code for the Smuggler Extension), I noticed that the Extension appears to be more comprehensive. Is this correct? The reason I ask is that the Extension includes features for testing HTTP Desync attacks in HTTP/2 scenarios, as well as other techniques and attacks, such as Connection-State attacks and unusual behaviors like header removal. However, if I'm mistaken, I would appreciate any corrections. I also have another question, which is not directly related to this topic, but I hope you can help. As I delve deeper into HTTP Desync attacks, I'm curious whether the term "HTTP Desync attacks" is being used incorrectly as a synonym for "HTTP Request Smuggling." From my understanding, HTTP Desync attacks are a broader category that encompasses various attacks exploiting discrepancies in how data is handled between different entities or components. HTTP Request Smuggling (HRS) is just one part of this broader category. For example, I recently came across research on Confusion Attacks (https://blog.orange.tw/2024/08/confusion-attacks-en.html), which, in my opinion, could also fall under the umbrella of HTTP Desync attacks since they involve discrepancies among different entities, such as Apache modules. What are your thoughts on this? Do you think my understanding is correct? Thank you for your time and support!

Syed, PortSwigger Agent | Last updated: Aug 15, 2024 09:52AM UTC