Web Basics
HTTP header
Penetration Testing Frameworks
When you're doing a pentest, you can't just randomly poke at things and hope something breaks. You need a structured approach — something that tells you what to test, in what order, and how to prove you tested it. That's what frameworks are. They're not rules you follow blindly; they're maps that prevent you from missing entire attack surfaces.
Routing
Note https://youtu.be/SubuU1iOC2s?si=Rq3nCiC4bbwIVXsI
HTTP Framer Desync
I'm building an HTTP server from scratch on raw TCP in Node.js (no node finding where one request ends and the next begins. Along the way I wrote a desync bug myself, and it turned out to be the same core idea behind HTTP request smuggling.
CVE-2026-118762: Pwn Request in Monkeytype's CI
| | |