Gudifu: Guided Differential Fuzzing for HTTP Request Parsing Discrepancies
Bahruz Jabiyev, Anthony Gavazzi, Kaan Onarlıoğlu, Engin Kirda · 2024
Modern web applications involve multiple HTTP processors on the traffic path, each acting as a reverse proxy and processing client requests. Even when such proxies are secure in isolation, when combined into complex systems, minor HTTP parsing discrepancies between them can lead to various severe attacks such as cache poisoning and HTTP request smuggling attacks.