HTTP Protocol Checks (PROTO)

Scope & Objectives

• Cover protocol-layer attacks that exist because two HTTP parsers disagree about where one message ends and the next begins, or about which client-supplied header is authoritative:
  • HTTP request smuggling (CWE-444): CL.TE desync, TE.CL desync, TE obfuscation variants (malformed/duplicated/obs-folded Transfer-Encoding), H2→H1 downgrade ambiguity, CL.0 (backend ignores Content-Length on specific routes).
  • Host-header attacks: password-reset poisoning via Host / X-Forwarded-Host, routing confusion (vhost selection, default-server catch-all), SSRF-via-Host when an upstream is derived from the host value, and the bridge into cache attacks.
  • Web cache poisoning and deception: unkeyed headers reflected into responses, fat GET, reflection into Set-Cookie or redirects, extension-based cacheability rules abused by path-suffix tricks (/settings/nonexistent.js).
  • HTTP parameter pollution (HPP): duplicate-parameter resolution divergence across stacks, split-brain between validation layer and business consumer.
  • Header-based attack surface: spoofable proxy-set internal headers (X-Original-URL, X-Rewrite-URL, X-Forwarded-*), overlong header/URI handling mismatches, Expect/Trailer edge cases, CRLF injection from app code (cross-ref INJ module for the code-level sink inventory).
  • Connection semantics: keep-alive pinning concepts; WebSocket upgrade hijacking is one line here and is fully covered by the API module (cross-ref API module).
• This module's findings are usually configuration-level, not code-level: the fix is almost always proxy/LB/cache configuration hardening, not application refactoring. Frame every deliverable accordingly.
• Code-audit posture: you normally cannot send live probes against production. The core method is therefore: build a front-end map from deployment artifacts, identify both sides of each hop, apply known desync-matrix reasoning per stack pair, and document ambiguity pairs as findings with config fixes. Dynamic payloads in Exploitation & Reproduction are for authorized lab verification only.

Prerequisites & Vocabulary

Zero-background primer: the terms this module uses, one line each. Deeper plain-language explanations for every class live in the repository GUIDE.md glossary.