HTTP/2: The Sequel is Always Worse - James Kettle (albinowax)

HTTP/2 is easily mistaken for a transport-layer protocol that can be swapped in with zero security implications for the website behind it. Two years ago, James presented HTTP Desync Attacks and kicked off a wave of request smuggling, but HTTP/2 escaped serious analysis. In this presentation, James will take you beyond the frontiers of existing HTTP/2 research, to unearth horrifying implementation flaws and subtle RFC imperfections.

Considering the impact of these the bounties are kind of ridiculously low. This guy just owned half of all internet services.

[stupidmonkeyx]

Thanks James for sharing your research; forever grateful.

[bokunochannel]

This is huge and you've spent >1year researching. I think you deserve more rewards.

[haythamkt]

My mother walked on me watching this and I immediately switched to porn because it is easier to explain

[oreli]

Great presentation! I learned a lot. Thank you.

[alan.m.rebeira]

Will we see HTTP/3 attack next defcon event

[chipoleto]

Amazing presentation! Thanks for sharing. However, I wonder what is the impact of the bottle behind you? Can you ellaborate ?

[fabcotechnologies]

Outstanding research. I use nginx and in many stacks I'm doing http2 downgrading, maybe I should http2 until nodeJS. Is nginx vulnerable to the attacks you showed ?

[hdphoenix]

thanks for this great content,
i've only could exploit request smuggling to myself everywhere i tried :(