How to turn security research into profit: a CL.0 case study

Summary: PortSwigger researcher James Kettle describes how he added obfuscation techniques from an older paper plus some of his own to the CL.0 desync scan check in HTTP Request Smuggler, then ran it against his 20GB Burp Suite project file of bug bounty sites. A few hours later the scan had surfaced around a hundred vulnerable websites across roughly 15 bug bounty programs.
Bottom line: The CL.0 desync class sat largely overlooked for two years because no tool tested for it, and a few hours of coding against an existing project file turned that gap into roughly a hundred vulnerable sites across 15 programs - a reminder that the bug classes your scanners don't cover are the ones quietly sitting in your estate.

Read the original at PortSwigger Research ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026