Forget the toy examples. This is a byte-level breakdown of HTTP request smuggling: how parsing differentials arise in proxy chains, why H2 downgrade reintroduces eliminated attack surface, and why a low-reliability primitive in staging becomes an automated credential harvester in production.
TIME_WAIT and Sockstress don’t translate directly to UDP DNS, but DNS has its own state surface. Recursive-client tables, pending-query slots, TCP/853 (DoT) and TCP/443 (DoH) sockets, delegation chains, and DNSSEC validation state are all exhaustible. This post covers water torture, NXNS, TsuNAME, NRDelegation, and the operational defaults that make DNS a softer target than HTTP.
The ‘65536 port’ framing is wrong. TCP connection capacity is governed by 4-tuple uniqueness and kernel state tables, not port counts. This post breaks down TIME_WAIT exhaustion, Sockstress (window=0 + Persist Timer abuse), Slowloris-class L7 variants, and the conditions under which each is still effective today.
Throw away python -m http.server. Discover how to build a bare-metal web server from scratch using x64 Assembly, featuring zero-copy file transfers and manual IP parsing.
Consistency is key in high-speed data. Beyond simple latency, jitter reveals the true health of a network. Discover how to bypass OS clock noise using RDTSC for nanosecond-scale precision.
Scapy or C are easy, but true control lies in the CPU cycles. Learn how to build a raw socket sniffer from scratch in x64 Assembly, bypassing libc for pure kernel interaction.
