New differential fuzzing tool reveals novel HTTP request smuggling techniques

Re:New differential fuzzing tool reveals novel HTTP request ... by beebmam on Friday November 26, 2021 @12:27AM (#29347693)

Http is application layer, it should have nothing to do with an operating system. In fact, the OS should likely have no access to the HTTP frame at all, if the connection uses TLS

[ Parent | on HN ]

Re:New differential fuzzing tool reveals novel HTTP request ... by Joker_vD on Friday November 26, 2021 @05:59AM (#29349127)

Can we please stop with this OSI nonsense already? HTTP is a transport-level protocol today. If something uses TCP, chances are pretty good it also uses HTTP on top of that, and some sort of homegrown RPC on top of that.

And the OS absolutely has access to the HTTP frame: it manages the process's network buffers and its whole memory mapping, it locates and loads OpenSSL at the process's startup... a process is really not a black box from the OS point of view.

[ Parent | on HN ]