Skip to content
This repository has been archived by the owner on Mar 14, 2020. It is now read-only.

Latest commit

 

History

History
13 lines (9 loc) · 590 Bytes

README.md

File metadata and controls

13 lines (9 loc) · 590 Bytes
Raw

VulnerableGunicorn

This is a simple application and infrastructure to test HTTP Desync Attacks against Gunicorn+Flask running in ECS behind an AWS ALB.

The whole process is detailed in my blog post.

Deploy

  1. In the infra folder, terraform apply
  2. Change the AWS account ID in the deploy.sh script
  3. ./deploy.sh

Thanks

The application is largely inspired by code used in the blog post HAProxy HTTP request smuggling.