Antoine Roly @aroly.bsky.social · 28/05/2025Thanks for the tip ! I'm slowly making progress. For now I can redirect users to arbitrary URLs by poisoning the queue like you showed in your paper. Stealing other people's responses would be much cooler though :) 120
Antoine Roly @aroly.bsky.social · 28/05/2025No clue if this will be exploitable, but it's at least interesting: when I add an incorrect "X-Forwarded-Port" header using HTTP Request Splitting (CRLF injection with Nginx proxy), I trigger a HTTP 400 and I can then tunnel other HTTP1 requests to the backend. Poke @t0xodile.com for the tunneling 250
Antoine Roly @aroly.bsky.social · 27/05/2025I often end up testing weird things, but my current test is so weird that @burpsuite.bsky.social can't even handle in propery if I use the Repeater custom action 😅 010
Antoine Roly @aroly.bsky.social · 15/05/2025I'm a big fan of these issues, but I always struggle to actually exploit them 😅 010
Antoine Roly @aroly.bsky.social · 02/05/2025Yep, really weird... This HTTP 504 comes from Cloudflare when I add a Content-Length header using Nginx "CRLF injection" / Request Splitting. The other responses seem to come from the origin server. 🤔😅 But I can't get a valid response unfortunately... 010
Antoine Roly @aroly.bsky.social · 02/05/2025When the same HTTP request gets you 3 different response code, you known something is weird... And thanks @jameskettle.com for the race condition custom action, it's really convenient to have it directly in Repeater. 182
Antoine Roly @aroly.bsky.social · 30/04/2025Bug bounty programs: - only use your own accounts to test, - create multiple accounts to test for access control issues, - use your bug bounty platform email otherwise you're not elligible for a bounty. Also bug bounty program: 010
Antoine Roly @aroly.bsky.social · 29/04/2025When you test a path traversal in a parameter, and you get a HTML error response in a JSON message :) 110
Antoine Roly @aroly.bsky.social · 07/03/2025Ouais bon... Sur le principe, pq pas, mais c'est pas vraiment développé quoi :D 000
Antoine Roly @aroly.bsky.social · 26/02/2025As a fan of server side issues in webapps, and having played a bit with "HTTP request splitting" lately, I'm really a big fan of "Http Garden" ! It's so cool to be able test things locally, and see the result of proxying weird chars in HTTP requests. 000
Antoine Roly @aroly.bsky.social · 25/02/2025I should make a thread of all the weird things I ran into while hunting. It's not really useful, but I like these "What the hell ?!?" moments :) This one returns the page code when I do a POST on this aspx endpoint. 230
Antoine Roly @aroly.bsky.social · 31/01/2025Another weird one... On this host, all the OPTIONS responses are sent back with all the request's HTTP headers. Probably nothing to do with this, but... why ? 210
Antoine Roly @aroly.bsky.social · 21/01/2025This occurs 9 times out of 10. @hacker0x01.bsky.social you should really do something about it... 120
Antoine Roly @aroly.bsky.social · 17/01/2025By injecting CRLF characters in the URL, I'm able to split the request at the GCP level and inject a different "Host" header for Cloudflare. I then just have to provide my own Cloudflare "Host" header to fetch the content from my server instead of the expected one. 130
Antoine Roly @aroly.bsky.social · 16/01/2025It also happens in the browser after a few tries, so it's obviously not Burp. 000
Antoine Roly @aroly.bsky.social · 16/01/2025I noticed a weird behaviour while playing with "HTTP Request Splitting". I sometimes get two HTTP responses in Burp repeater when I repeatedly send this request. Any idea what's going on ? Is it just an error from Burp ? #BugBounty @jameskettle.com maybe ? :) 200
Antoine Roly @aroly.bsky.social · 17/12/2024When you randomly test for HTML injection / XSS and your imput gives unexpected results... :) 010
Antoine Roly @aroly.bsky.social · 16/12/2024DomInvader actually showed me a sink but no source, I guess there's not much I can do. I'm gonna look for for a XSS on the site. 100
Antoine Roly @aroly.bsky.social · 14/12/2024It's a first with DomInvader... Now I just have to find what to do with this 😂 Poke @garethheyes.co.uk 110
Antoine Roly @aroly.bsky.social · 13/12/2024Interesting: this endpoints, for some reasons, reflects all request's headers in the response. I tried to add a "X-Accel-Redirect" to the request, and it seems to be interepreted by the proxy on the way back. Wondering now if this can be used somehow... 010
Antoine Roly @aroly.bsky.social · 06/12/2024I find actually interesting how many webservers are NOT RFC compliant when using the "X-Forwarded-Host" header. It is supposed to have the same syntax as the "Host" header, but a lot of servers accept a path after the host to build the final URL, either for redirection or to fetch ressources. 030
Antoine Roly @aroly.bsky.social · 03/12/2024Interesting: this webb app uses the "X-Forwarded-Host" header with the requested URL to built the final URL. The XFH header can include path and parameters, not just the host, and everything is combined. This gave me an easy 403 bypass at the proxy level, but I wonder what else can be done... 0122
