Client Side Desync Attack
The term “Client Side Desync Attack” refers to a type of security vulnerability that can be exploited on the client side of a web application. This concept is inspired by research conducted by PortSwigger, a company known for its web security tools, including Burp Suite.
In the context of web security, “desync” typically refers to desynchronization or inconsistencies in the interpretation of HTTP requests by different components of a web application. This can happen when there’s a misinterpretation of the HTTP protocol, leading to discrepancies in how the client (browser) and server process the requests.
The specific attack mentioned in the PortSwigger research is related to “Request Smuggling.” Request smuggling is a technique where an attacker manipulates the way a web server processes HTTP requests. The goal is often to trick the server into processing the requests differently from how the client interprets them, leading to security vulnerabilities.
The “Client Side Desync Attack” may involve manipulating HTTP requests on the client side in a way that could lead to desynchronization between the client and the server, potentially causing security issues. It’s important to note that exploiting such vulnerabilities requires a deep understanding of the HTTP protocol and how web servers handle requests.
Client Side Desync Chrome Extension Tutorial
[Step 1: Install the Extension]
Ensure that you have the Chrome extension installed in your browser.
[Step 2: Open a Website]
Open a website where you want to test the extension.
[Step 3: Access Developer Tools]
Right-click on the page and select “Inspect” or use the keyboard shortcut Ctrl + Shift + I to open the Chrome Developer Tools.
[Step 4: Back to Target]
Stay focus and proceed to Step 5.
[Step 5: Input URL]
1. Locate the input box labeled “URL.”
2. Enter the desired URL, e.g., https://example.com.
[Step 6: Input Body Data]
1. Locate the input box labeled “Body Data” or “POST Data.”
2. Enter the body data, e.g., GET /404 HTTP/1.1.
[Step 7: Click “Desync!”]
1. Locate the button labeled “Desync!” on the webpage.
2. Click the button TWICE to initiate the CSD attack.
[Step 8: Observe Network Requests]
1. Navigate to the “Network” tab in the Chrome Developer Tools.
2. Observe the network requests to see if any anomalies or desynchronization has occurred.
[Step 9: Check Results]
1. Return to the “Network” tab in the Chrome Developer Tools
2. Check for any additional or modified network requests.
[Step 10: Analyze Results]
Analyze the results in the Developer Tools to understand how the extension manipulated the requests and if any desynchronization occurred. Pay attention to request/response headers and statuses.
Probing for CL.0
Testing for client-side desync vulnerabilities involves finding a way to make the server ignore the Content-Length header. You can start by sending a request where the stated Content-Length is longer than the actual body. This helps identify potential issues with how the server processes such requests.
Get Angry Oval Egg’s stories in your inbox
Join Medium for free to get updates from this writer.
1. Switch from a GET request to a POST request.
2. Make the Content-Length 1 or more, but don’t include any content in the request body.
3. Send the request and notice if the server responds right away without waiting for the body. This indicates that the server might be ignoring the given Content-Length.
CL.0 Vulnerabilities
As with CL.0 vulnerabilities, we’ve found that the most likely candidates are endpoints that aren’t expecting POST requests, such as static files or server-level redirects.
Static Files:
- Images (.jpeg, .png, .gif, .avif)
- Stylesheets (.css)
- JavaScript files (.js)
Server-level Redirects:
- HTTP Redirects like /en
- HTTP Redirects like /home
- HTTP Redirects like /visitor
- HTTP Redirects like /web
- HTTP Redirects like /mobile
Author's Note
“As a mobile user with a keen interest in web security, I’ve developed a Client Side Desync Chrome extension tailored for those who rely on mobile phones to explore the digital landscape. This extension serves as a valuable tool for detecting Client Side Desynchronization (CSD) vulnerabilities, providing insights into potential security gaps in web applications.
For mobile enthusiasts using the Kiwi Browser, the client side desync chrome extension seamlessly integrates, allowing you to harness its capabilities while navigating the online world. Enhance your awareness of CSD vulnerabilities and contribute to a safer web experience by installing the extension through the Kiwi Browser:
[Download Kiwi Browser](https://play.google.com/store/apps/details?id=com.kiwibrowser.browser)
[Download Client Side Desync Chrome Extension](https://github.com/schooldropout1337/clientsidedesync)
Empower your mobile security exploration with the Client Side Desync Chrome extension and delve into the intricacies of web security on the go.”
