Light

Episode #846 Quiz

HTTP REQUEST SMUGGLING
Date: 2021-11-23 | Length: 1.75 hrs | Episode page at twit.tv

About this episode

The episode examines HTTP request smuggling, where front-end and back-end servers disagree on request boundaries because of conflicting Content-Length and Transfer-Encoding handling. Attackers can smuggle hidden requests past proxies, caches, and web application firewalls, enabling cache poisoning, session hijacking, XSS, and WAF bypasses. Mitigations require consistent parsing and strict normalization.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: What specific change did the IETF proposal make to the IPv4 loopback reservation in 127/8?

Question 1

What specific change did the IETF proposal make to the IPv4 loopback reservation in 127/8?

It kept only 127.0.0.0/16 reserved for loopback use It kept only 127.0.0.0/8 reserved for loopback use It moved loopback use from 127/8 to 127.0.0.0/24 It reassigned 127/8 to multicast and broadcast traffic

Question 2: According to Ross Bevington's honeypot data, which password length was the most commonly attempted in brute-force attacks?

Question 2

According to Ross Bevington's honeypot data, which password length was the most commonly attempted in brute-force attacks?

Twelve characters Ten characters Eight characters Six characters

Question 3: Which pair of HTTP headers is manipulated in request smuggling to create disagreement about where one request ends and the next begins?

Question 3

Which pair of HTTP headers is manipulated in request smuggling to create disagreement about where one request ends and the next begins?

Cache-Control and ETag Origin and Referer Host and Cookie Content-Length and Transfer-Encoding

Question 4: In the Netgear router vulnerability discussed, what protocol feature made the attack possible from the LAN side?

Question 4

In the Netgear router vulnerability discussed, what protocol feature made the attack possible from the LAN side?

Unauthenticated UPnP requests on the internal interface Encrypted TLS renegotiation on the management port Signed firmware updates delivered over WAN access Authenticated SSH sessions on the external interface

Question 5: Which server pairs did the researchers systematically fuzz to map HTTP Request Smuggling discrepancies?

Question 5

Which server pairs did the researchers systematically fuzz to map HTTP Request Smuggling discrepancies?

CloudFront, F5, Juniper, Palo Alto, Cisco, Barracuda, Brocade, Zscaler, Netscaler, and SonicWall NGINX, Apache, IIS, Tomcat, Jetty, Lighttpd, OpenResty, HAProxy, Squid, and Varnish CloudFront, Cloudflare, Akamai, Varnish, Squid, HAProxy, ATS, Tomcat, NGINX, and Apache Fastly, ModSecurity, Lighttpd, Jetty, IIS, Caddy, Envoy, Redis, PostgreSQL, and Oracle

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.