Rating: 5.0

A HTTP desync between HAProxy and Gunicorn with malform `Transfer-Encoding:\vchunked` header leads to stealing flag from Flag BOTS HTTP request.

Original writeup (https://blog.shoebpatel.com/2020/05/18/DefCon-CTF-2020-HTTP-Desync-between-HAProxy-Gunicorn/).
ScalpelMay 18, 2020, 5:26 p.m.

Good write-up!