BEWARE THE FALSE FALSE-POSITIVE: HOW TO DISTINGUISH HTTP PIPELINING FROM REQUEST SMUGGLING

Summary from the TLDR InfoSec newsletter

Sometimes, when people are hunting for HTTP request smuggling vulnerabilities, they actually run into false positives caused by connection reuse. Some scenarios where connection reuse may be necessary for finding vulnerabilities include situations where the frontend server only reuses the upstream connection if the client connection was reused, connection-state attacks, and client-side desync attacks. James Kettle created a Custom Action for Burp Suite called `Smuggling or pipelining?` to distinguish between a genuine HTTP smuggling attack and an HTTP pipelining false-positive.