The Entire Internet is Broken

Value of the Information & Strength of the Argument

The video provides valuable insights into the current state of HTTP/1.1 security, backed by real-world examples and demonstrations. Kettle’s argumentation is solid, as he explains the technical details of request smuggling and shows how seemingly minor discrepancies can lead to severe vulnerabilities. The demonstration of the scanning tool adds practical value, showing how these issues can be identified. The discussion is well-structured, moving from the basics to advanced exploitation techniques, making it accessible to a technical audience.

Scientific Rigor, Source Quality, Title Accuracy

The video references James Kettle’s research and the HTTP/1.1 must die website, which provides a white paper and labs. The sources are credible, as Kettle is a well-known researcher in the field. The title is somewhat sensational but accurately reflects the content’s claim that HTTP/1.1 is fundamentally broken. The video does not cite external sources beyond the research itself, but the information is presented with technical depth and practical demonstrations, enhancing its credibility.

The title is somewhat sensational but accurately reflects the content's claim that HTTP/1.1 is fundamentally broken and affects a large portion of the internet.

8/10

Interview with James Kettle, a recognized security researcher, discussing his latest research on HTTP/1.1 vulnerabilities. The claims are supported by references to real-world exploits and bounties, but the video is primarily a discussion and demonstration rather than a peer-reviewed study.

Markers derived by PSI from the transcript: the creator did not define chapters.

• 00:00Introduction and context of the interview with James Kettle.
• 01:00Kettle explains the history of request smuggling and its impact.
• 03:00Explanation of how request smuggling works and its consequences.
• 05:00Demonstration of the HTTP Request Smuggler tool and parser discrepancy scan.
• 08:00Discussion on hiding headers and the zero-CL desync technique.
• 10:00Exploitation of the desync to achieve cache poisoning and response queue poisoning.
• 12:00Impact on CDNs and the scale of compromise (30 million websites).
• 14:00Bug bounty earnings and the decision to donate them.
• 16:00Recommendations for fixing the issue, including moving to HTTP/2.
• 18:00Future research directions and closing remarks.

• HTTP/1.1 Must Die — James Kettle's research page with white paper and labs.
• PortSwigger — Sponsor and developer of Burp Suite, the tool used in the demonstration.
• Just Hacking Training — Training platform by John Hammond.
• Newsletter — John Hammond's newsletter for updates.
• CodeCrafters — Affiliate link for learning to code.
• OpenVPN — Affiliate link for hosting VPN.
• CyberDefenders — Affiliate link for blue team training.

• PortSwigger Research — PortSwigger's research page, which includes related articles on request smuggling and desync attacks.
• HTTP Request Smuggler Tool — Open-source tool used in the video for detecting request smuggling vulnerabilities.

• HTTP/1.1 is fine for simple use cases — Some commenters argue that HTTP/1.1 is acceptable for simple, non-sensitive applications, but this does not negate the vulnerabilities discussed.