Cracking the lens: targeting HTTP's hidden attack-surface
Summary: PortSwigger researcher James Kettle showed that malformed requests and esoteric headers can force reverse proxies, load balancers and backend analytics systems to reveal themselves, using pingback payloads sent to roughly 50,000 IP addresses listening on port 80/443 out of a few million identified. The technique let him exploit 27 DoD servers, earn over $30k in bounties including $15,000 and $5,000 from Yahoo, and accidentally exploit his own ISP, BT, which was intercepting port 80 traffic to blacklisted IPs.
What you should know: Reverse proxies sit directly on the internet with access to the DMZ or the entire internal network, so a single misrouted Host header can turn one into an open gateway - and Kettle found 27 DoD servers and a Yahoo load balancer pool that could be reconfigured via a plain HELP command.
Read the original at PortSwigger Research ↗
- Topics
- Supply Chain & AppSec
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026