Talks

Upcoming

Splitting the Email Atom: Exploiting Parsers to Bypass Access Controls HTTP/1.1 Must Die! The Desync Endgame

Splitting the Email Atom: Exploiting Parsers to Bypass Access Controls

Conferences

NDC Manchester, 03 Dec 2025

Websites often parse users' email addresses to identify their organisation. Unfortunately, parsing emails is far from straightforward thanks to a collection of ancient RFCs that everyone knows are crazy. You can probably see where this is going...

In this session, I'll introduce techniques for crafting RFC-compliant email addresses that bypass virtually all defences leading to broken assumptions, parser discrepancies and emails being routed to wildly unexpected destinations. I'll show you how to exploit multiple applications and libraries to spoof email domains, access internal systems protected by 'Zero Trust', and bypass employee-only registration barriers.

Then I'll introduce another class of attack - harmless-looking input transformed into malicious payloads by unwitting libraries, leading to yet more misrouted emails, and blind CSS injection on a well-known target.

I'll leave you with a full methodology and toolkit to identify and exploit your own targets, plus a CTF to develop your new skillset.

HTTP/1.1 Must Die! The Desync Endgame

Researcher: James Kettle

Conferences

Black Hat USA 2025, 06 Aug 2025, 15:20

DEF CON 33, 08 Aug 2025, 16:30

RomHack, 27 Sept 2025

Some people think the days of critical HTTP request smuggling attacks on hardened targets have passed. Unfortunately, this is an illusion propped up by wafer-thin mitigations that collapse as soon as you apply a little creativity. As long as HTTP/1.1 lives upstream, desync attacks will thrive.

In this session, I'll introduce multiple new classes of desync attack, enabling mass compromise of user credentials across hundreds of targets, including tech giants, SaaS providers, US government systems, and almost every company using a certain CDN. Every technique has been honed for maximum impact with minimum effort, with an unplanned collaboration yielding over $200,000 in bug bounties in two weeks.

I'll also share the research methodology and open-source toolkit that made this possible, replacing outdated, canned-exploit probes with focused analysis that reveals each target's unique weak spots. This strategy creates an avalanche of desync research leads, yielding results ranging from entire new attack classes, down to exotic implementation flaws that bleed server memory into attackers' welcoming arms. You'll witness attacks meticulously crafted from theoretical foundations alongside accidental exploits with a root cause so incomprehensible, the developers ended up even more confused than me.

You'll leave this talk equipped with everything you need to join me in the desync research endgame: the mission to kill HTTP/1.

Talks

Upcoming

Splitting the Email Atom: Exploiting Parsers to Bypass Access Controls

Conferences

HTTP/1.1 Must Die! The Desync Endgame

Conferences

Previous

HTTP Stream Hacker

WebSocket Turbo Intruder

Amplify the hacker: offensive AI plugin development

Cookie Chaos: Exploiting Parser Discrepancies

Digging for XSS Gold: Unearthing Browser Quirks with Shazzer

Splitting the email atom: exploiting parsers to bypass access controls

Listen to the Whispers: Web Timing Attacks that Actually Work

Gotta Cache Em All: Bending the Rules of Web Cache Exploitation

Smashing the State Machine: The True Potential of Web Race Conditions

Server Side Prototype Pollution: Blackbox detection without the DoS

Browser-Powered Desync Attacks: A New Frontier in HTTP Request Smuggling

Hunting evasive vulnerabilities: finding flaws that others miss

HTTP/2: The Sequel is Always Worse

Black Hat Europe Locknote: Conclusions and Key Takeaways

Portable Data exFiltration: XSS for PDFs

Web Cache Entanglement: Novel Pathways to Poisoning

XSS Magic Tricks

HTTP Desync Attacks: Smashing into the Cell Next Door

Turbo Intruder: Embracing the billion-request attack

Practical Web Cache Poisoning: Redefining 'Unexploitable'

Exploiting Unknown Browsers and Objects

DOM based AngularJS Sandbox Escapes

Cracking the Lens: Targeting HTTP's Hidden Attack-Surface

Exploiting CORS Misconfigurations for Bitcoins and Bounties

Backslash Powered Scanner: Automating Human Intuition

JSON Hijacking for the Modern Web

Hunting Asynchronous Vulnerabilities

Server-Side Template Injection