Making HTTP header injection critical with one prompt
Summary: PortSwigger Research released a new Burp Scanner check for HTTP Request Header Injection and a Burp AT skill that automates its CRLF-Powered Desync methodology, escalating header injection to a desync and then to an open-redirect exploit in a single prompt. The skill runs in phases: identifying whether the injection lands in a custom header before or after the upstream host header, fuzzing prefix payloads until two or three distinct status codes confirm upstream modification, crawling for open redirects via the Host header, X-Forwarded-Host header or an absolute URL, and combining the pieces into an exploit that redirects users to a collaborator domain.
Why it matters: PortSwigger says it avoided Response Queue Poisoning because it proved too dangerous in testing, and notes the reported redirect exploit is the primitive for a full-site takeover when chained with cache poisoning - so the tool deliberately stops short of the impact an attacker would pursue.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026