logo
HackAllTheThings
Head Smuggling
Initializing search
    GitHub
    GitHub
    • Hack All The Things
    • About me
    • Data Protection
    • Development Resources
    • OSINT
    • Security Architecture
    • Segmentation Testing
    • Threat Modeling
    • Vulnerability Scanning
      • Checklist
      • Fundmentals
      • Local Privilege Escalation - Work in progress
      • PowerView Dev Cheatsheet
      • Remote Enumeration
      • Mimikatz
      • Apache Cordova
      • Decompiling and Compiling Smali
      • Flutter
      • Frida
      • Learning Resources
      • My Testing Enviroment
      • Security Controls
      • Xamarin
        • AndroidManifest.xml
        • Root Detection
        • Intents
        • Build Settings
        • Checklist
        • Crypto APIs
        • Local Authentication
        • Misc
        • Network APIs
        • Network Controls
        • Tutorial
        • Other
        • Platform APIs
        • Resources
        • Backups
        • Static Analysis
        • Traffic Analysis
      • OASP
      • OSEP
      • OSWE
      • AWS Cli Cheatsheet
      • Bettercap
      • Frida & Objection cheatsheet
      • WebApplication Tooling
      • Configure WinDBG
      • adb Cheatsheet
      • Drozer cheatsheet
      • Jdb cheatsheet
      • R2frida cheatsheet
      • AWS Assessment
      • Azure AD Assessment
      • Azure
      • Azure Hardening Checklist
      • Azure best practices for network security
      • GCP Assessement
      • Kubernetes Assessment
      • Platform Agnostic Testing
      • Terraform Assessment
      • Hooking events using Inotify in C
      • C Linux Bind Shell
      • CMD Library
      • HSQLDB
      • MySQL
      • PSQL
      • SqlLite
      • C++ Win32 Applications
      • Checklist
      • Frida Windows
      • Hooking into an ELF binary
      • Tips and tricks
      • Win32 Internals
      • ASMI Bypass
      • Abusing Signed Executables
      • DNS Staging
      • Resources
      • Learning Resources
      • WinDbg
      • Msfvenom
      • Embedded Linux
      • Convert Debain to Kali
      • Kerberos
      • Local Machine Persistence
      • Miscellaneous
      • Privilege Escalation Checklist
      • Binaries
      • Convert Debain to Kali
      • Empire 4.0
      • Git
      • Hashcat
      • Interesting Reads
      • My host setup
      • PWN
      • Physical Attacks
      • Pivot & Tunnel
      • Scripting
      • Interactive Shells
      • Simple Servers
      • Social Engineering
      • Wordlists
      • jq
      • neo4j
      • Automation
      • DNS
      • DNS Rebind Attacks
      • IPv6
      • MSRPC
      • Port Scan
      • Resources
      • SMB
      • SMTP
      • SSH
      • Sniffing
      • gRPC
      • Obtaining Authorization
      • Scoping
        • Cloud Config Reviews
        • Web Application and API Penetration testing
        • CVSS 3.1
        • CVSS Shortcomings
        • OWASP Risk Rating
        • OWASP Shortcomings
      • 2FA SSH
      • Headscale Work in progress
      • Nginx Work in Progress
      • SEO Optimization
      • Bash Scripting
      • DotNet Debugging
      • Methodology
      • Database Logging
      • Methodology
      • Misc
      • Node
      • PHP
      • Python Debugging
      • Resources
      • Tooling
      • Java
      • Grammar
      • Public Pen test reports
      • Technical Writing for Educators - Work in progess
      • Technical Writing for Engineers
      • Writing Checklist
      • Writing Error Messages Checklist
      • Writing Helpful Error Messages
      • Tailscale
      • Burp Extensions
      • CMS
      • Resources
      • Salesforce Testing
      • Tips and Tricks
      • WAF & Directory Brute Forcing
        • API Testing Checklist
        • API Tooling
        • Resources
        • AWS LocalStack
        • CORS
        • CSRF
        • CSV Injection
        • ClickJacking
        • Dangling markup injection
        • OGN/Expression Language Injection
        • HTTP Host header
        • LDAP Injection
        • Leak Server IP Address (WAF bypass)
        • Logic Attacks
        • Methodoloy
        • Misc
        • OAuth Workflow
        • SSL Certificate
        • SSRF
        • SSTI
        • Serialization
        • Server Side Include/SSI
        • Web cache poisoning
        • WebSockets & WebWorkers
        • XSLT Engines
        • XSS
          • Head Smuggling
          • Nginx
        • CSRF
        • Click Jacking
        • MIME Sniffing
        • SSL Strip attack
        • WebSockets
        • Mitigations
      • Basics
      • Burp Suite Setup
      • Connect to Shell Over USB
      • Extract IPA From AppStore Application
      • Frida Setup
      • Frida
      • LLDB
      • Learning Resource
      • My Setup
      • Objection
      • Reversing iOS Apps with Ghidra
      • Tweaks

    Head Smuggling

    Practical HTTP Header Smuggling: Sneaking Past Reverse Proxies to Attack AWS and Beyond (intruder.io)

    Previous XSS
    Next Nginx
    Made with Material for MkDocs