Slack account takeovers using HTTP Request Smuggling
I was unfamiliar with request smuggling; here's an explainer: <a href="https://portswigger.net/web-security/request-smuggling" rel="nofollow">https://portswigger.net/web-security/request-smuggling</a><p>The first in-band signalling attack I came across was the blue box [1], invented in the late 1960s. It still occasionally worked in the 1980s on older phone systems. It amazes me that we're still creating new systems vulnerable to in-band attacks.<p>[1] <a href="https://en.wikipedia.org/wiki/Blue_box" rel="nofollow">https://en.wikipedia.org/wiki/Blue_box</a>