Slack account takeovers using HTTP Request Smuggling
I was unfamiliar with request smuggling; here's an explainer: https://portswigger.net/web-security/request-smugglingThe first in-band signalling attack I came across was the blue box [1], invented in the late 1960s. It still occasionally worked in the 1980s on older phone systems. It amazes me that we're still creating new systems vulnerable to in-band attacks.[1] https://en.wikipedia.org/wiki/Blue_box