Lab: 0.CL request smuggling
Summary: PortSwigger Research published a lab vulnerable to 0.CL request smuggling, a technique detailed in James Kettle's HTTP/1.1 Must Die whitepaper. The lab's simulated user Carlos visits the homepage every five seconds, and the exercise is to exploit the vulnerability to execute alert() in his browser.
Why it matters: The flaw class is documented in a whitepaper by the researcher who found it, and the lab's target is a browser executing attacker-supplied script on a recurring five-second visit - the same pattern a real victim's session would follow.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026