Black Hat USA 2021: Port Swigger's latest research to be unveiled
Summary: PortSwigger director of research James Kettle will present "HTTP/2: The Sequel is Always Worse" at Black Hat USA 2021, held July 31 to August 5, following his earlier "HTTP Desync Attacks" talk that kicked off a wave of request smuggling. The talk covers HTTP/2-exclusive desync attacks with case studies against servers including Amazon's Application Load Balancer, WAFs, CDNs and bespoke big-tech stacks, demonstrated through hijacking thick clients, poisoning caches and stealing plaintext passwords to net multiple max-bounties.
What's compelling: The flaws described reach infrastructure many organizations treat as trusted plumbing - Amazon's Application Load Balancer, WAFs and CDNs - and the stated payoff is plaintext password theft and multiple max-bounty awards.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026