HTTP Protocol Internals & Offensive Semantics

Train an experienced web/API pentester and bug bounty hunter to predict vulnerabilities that arise when two components interpret the same HTTP message differently. Assume fluency with HTTP requests, Burp Suite, common web vulnerabilities, TLS, proxies, APIs and web architecture, and never re-explain them. Use RFC 9110 as the semantic backbone, then RFC 9111, 9112, 9113, 9114, 9204, 9213, 9421, 9530, 9651, 7239 and 6265. Every lesson must state the precise protocol mechanic, distinguish normative HTTP behaviour from implementation behaviour, connect it to real infrastructure (CDN, WAF, load balancer, reverse proxy, API gateway, framework, application), and answer: what could two parsers disagree about here? Show raw request and response bytes rather than describing them. Name real implementations whose behaviour differs. End every lesson with a concrete test the reader can run against a live target and the observable that decides the result. Label claims as established, inferred, or controversial. No fluff, no filler, no generic web-security advice.

11 sections ยท 98 lessons

Course outline

Section 1 - HTTP Semantics as an Attack-Surface Model

  1. Resources vs Representations: the Identity Layer
  2. Messages, Content, Metadata, and Application State
  3. Version-Independent Semantics vs Wire Format
  4. What Survives Protocol Translation and What Does Not
  5. Statelessness in HTTP's Model
  6. Connection-Attached State as Attack Surface
  7. Reading RFCs Offensively: MUST, SHOULD, and Recipient Requirements
  8. Extensibility Points, Error Handling, and Ambiguity as Attack Hypotheses
  9. Exercise: Tracing One Request Through CDN, WAF, LB, Proxy, App

Section 2 - Target URIs, Authority, Host, and Request Routing

  1. Determining the Target Resource: Scheme, Authority, Path, Query
  2. The Effective Request URI Across HTTP Versions
  3. Origin-Form and Absolute-Form Request Targets
  4. Authority-Form and Asterisk-Form
  5. Host, :authority, and Virtual-Host Routing
  6. Duplicate, Conflicting, and Malformed Authority Values
  7. Forwarded and the X-Forwarded-* Family
  8. Proxy Trust Reconstruction and Header Spoofing
  9. Exercise: Building an Authority Mutation Matrix
  10. Exercise: Locating Where Routing Decisions Are Made

Section 3 - Methods as Security Semantics

  1. Safe, Idempotent, and Cacheable Are Three Different Properties
  2. Where Gateways, Caches, and WAFs Guess Wrong About Methods
  3. GET and HEAD: Retrieval Semantics and Response Divergence
  4. POST vs PUT vs PATCH: Processing vs Replacement
  5. DELETE and Request Content Expectations
  6. OPTIONS, TRACE, and Max-Forwards
  7. CONNECT and Tunnelling Semantics
  8. Unknown Methods, Case Sensitivity, and Method Overrides
  9. GET-With-Body and HEAD Handling Discrepancies
  10. Exercise: The Method x Body Matrix
  11. Exercise: Attributing 405 to a Layer

Section 4 - Status Codes, Interim Responses, and HTTP Control Flow

  1. Status Codes as Machine Instructions, Not Labels
  2. 301, 302, 303: Method Rewriting on Redirect
  3. 307 and 308: Method and Body Preservation
  4. Location Construction, Redirect Caching, and Client Divergence
  5. Expect: 100-continue and Interim Responses
  6. Early Rejection and Unread Request Bodies
  7. 4xx Rejection Taxonomy as Parser Telemetry
  8. 421, 505, Connection Closure, and Timing as Oracles
  9. Exercise: One-Property-at-a-Time Malformed Request Families

Section 5 - HTTP Fields, Parsing, Normalization, and Hidden Inputs

  1. Field Name and Value Grammar
  2. Repeated Fields, Comma-Combination, and Ordering
  3. Connection and Hop-by-Hop Fields
  4. Nominated Headers, Trailers, and Hop Boundaries
  5. Name-Level Mutations: Case, Underscores, Malformed Names
  6. Value-Level Mutations: Whitespace, obs-fold, Line Endings, Unusual Bytes
  7. Structured Fields: Items, Lists, and Dictionaries
  8. Exercise: Building a Header Mutation Corpus
  9. Exercise: Recording Accept, Reject, Normalize, Combine, Strip, Rewrite

Section 6 - Representations, Content Semantics, Negotiation, and Ranges

  1. Representation Metadata vs Message Content
  2. Content-Encoding vs Transfer-Encoding vs Framing
  3. Server-Driven Negotiation: Accept, Accept-Encoding, Accept-Language
  4. Vary and Intermediary Interaction
  5. ETag, Weak vs Strong Validators, and Last-Modified
  6. If-Match, If-None-Match, If-Modified-Since, and If-Range
  7. Range, Content-Range, and 206 Responses
  8. multipart/byteranges, Overlapping and Malformed Ranges
  9. Digest Fields: Content-Digest vs Repr-Digest
  10. Exercise: Are All Layers Examining the Same Representation?

Section 7 - Authentication, State, Identity, and Message Integrity

  1. WWW-Authenticate, Authorization, and Protection Spaces
  2. HTTP Authentication vs Application Authentication
  3. Proxy-Authenticate and Proxy-Authorization
  4. Identity Boundaries Across Infrastructure Layers
  5. Cookie and Set-Cookie Parsing and Scoping
  6. Duplicate Cookies, Ordering, and Legacy Syntax
  7. RFC 9421 Signed Components and the Signature Base
  8. Derived Components, Canonicalization, and Coverage Gaps
  9. Exercise: Modelling Auth as Raw, Interpretation, Canonical, Decision

Section 8 - HTTP Caching as a Security Boundary

  1. The Cache Model: Storage, Cacheability, Private vs Shared
  2. Freshness, Age, Heuristics, and Validation
  3. Cache-Control, s-maxage, and Stale Directives
  4. Layered Caches: Browser, Framework, Reverse Proxy, CDN
  5. Cache Key Construction and Unkeyed Inputs
  6. From Unkeyed Input to Cache Poisoning
  7. Cache Deception and Path Parser Discrepancies
  8. Exercise: Reverse-Engineering an Unknown Cache Black-Box

Section 9 - HTTP/1.1 Message Framing and Desynchronization

  1. Request Lines, Message Boundaries, and Persistent Connections
  2. Why Body-Length Interpretation Is Security-Critical
  3. Content-Length vs Transfer-Encoding: Framing Precedence
  4. Chunked Coding Grammar, Malformed Chunks, and Trailers
  5. Classic Desync: CL.TE, TE.CL, and TE.TE
  6. CL.0, 0.CL, and Pause-Based Desync
  7. Header Smuggling Variants
  8. Front-End Bypass and Request Tunnelling
  9. Response Queue Poisoning and Credential Theft
  10. Exercise: Instrumenting a Two-Server Chain
  11. Exercise: Distinguishing Desync from Pipelining False Positives

Section 10 - HTTP/2, HTTP/3, Cross-Version Translation, and Novel HTTP Research

  1. Frames, Streams, and Multiplexing
  2. Pseudo-Headers and HPACK
  3. H2.CL and H2.TE: Downgrade Desync
  4. Pseudo-Header Injection, Request Splitting, and Tunnelling
  5. HTTP/3 over QUIC: Stream Independence and QPACK
  6. Connection Coalescing and Authority Assumptions
  7. A Methodology for Discovering New HTTP Attack Classes
  8. Micro-Hypotheses, Anomaly Detection, and Differential Evaluation

Section 11 - Capstone: From HTTP Knowledge to HTTP Research

  1. The Five Questions: Reducing Any HTTP Element to a Differential Test
  2. Testing Across the Full Chain
  3. Capstone Steps 1-4: Extract Rules, Generate Inconsistent Interpretations
  4. Capstone Steps 5-8: Series Testing and Generalising the Primitive

Start learning with Wondering