Lab: Web Cache Poisoning with URL Normalization

Lab: Web cache poisoning via a fat GET request

Lab: Web Cache Poisoning with Parameter Cloaking

Lab: Web cache poisoning via an unkeyed query parameter

Lab: Web cache poisoning via an unkeyed query string

Lab: Combining web cache poisoning vulnerabilities

Lab: Exploit a DOM vulnerability via a cache with strict cacheability criteria

Lab: Targeted web cache poisoning using an unknown header

Lab: Web cache poisoning with multiple headers

Lab: Web cache poisoning with an unkeyed cookie

Lab: Web cache poisoning with an unkeyed header

Lab: Server-side pause-based request smuggling

Lab: CL.0 request smuggling

Lab: Confirming a TE.CL vulnerability via differential responses – HTTP Request Smuggling

Lab: Confirming a CL.TE vulnerability via differential responses – HTTP Request Smuggling

Lab: Client-Side Desync

Lab: Web cache poisoning via HTTP/2 request tunnelling

Lab: Bypassing access controls via HTTP/2 request tunnelling

Lab: HTTP/2 request splitting via CRLF injection

Lab: HTTP/2 request smuggling via CRLF injection

Lab: Response Queue Poisoning via H2.TE request smuggling

Lab: H2.CL request smuggling

Lab: Exploiting HTTP request smuggling to perform web cache deception

Lab: Exploiting HTTP request smuggling to perform web cache poisoning

Lab: Exploiting HTTP request smuggling to deliver reflected XSS

Lab: Exploiting HTTP request smuggling to capture other users' requests

Lab: Exploiting HTTP request smuggling to reveal front-end request rewriting

Lab: Exploiting HTTP request smuggling to bypass front-end security controls, TE.CL vulnerability

Lab: Exploiting HTTP request smuggling to bypass front-end security controls, CL.TE vulnerability

Lab: HTTP request smuggling, basic CL.TE vulnerability