James Kettle

James Kettle, widely known by the handle albinowax, is a British web application security researcher who serves as Director of Research at PortSwigger, the company behind the Burp Suite web vulnerability scanner. He built a research career centered on finding overlooked classes of web vulnerabilities rather than one-off bugs. His early published research includes a 2013 blog post on practical HTTP Host header attacks, documenting password-reset-link poisoning and Host-header-based web cache poisoning techniques.

At PortSwigger, Kettle has led the research team that develops detection techniques built into Burp Suite's scanner and has personally authored several of the tool's most widely used extensions, including Param Miner, Turbo Intruder, and HTTP Request Smuggler. His 2016 talk 'Hunting Asynchronous Vulnerabilities' described exploit-induced callback techniques for finding blind, out-of-band vulnerabilities, feeding into the out-of-band testing capability PortSwigger built into Burp Collaborator.

HTTP Desync Attacks and Request Smuggling

Kettle's best-known work is his HTTP request smuggling research, presented as 'HTTP Desync Attacks: Smashing into the Cell Next Door' at Black Hat USA and DEF CON 27 in August 2019. The research showed how disagreements between front-end proxies/CDNs and back-end servers over where one HTTP request ends and the next begins could let a remote, unauthenticated attacker splice their request into another user's connection; it codified the now-standard CL.TE, TE.CL, and TE.TE taxonomy of front-end/back-end desynchronization. Kettle continued this line of research in subsequent years, extending desync techniques to newer HTTP protocol versions.

Cache Poisoning and Race Conditions

Beyond request smuggling, Kettle produced other influential web security research, most notably 'Practical Web Cache Poisoning: Redefining "Unexploitable"', presented at Black Hat USA 2018, which demonstrated how unkeyed HTTP inputs could be used to poison caches on real-world sites, leading him to release the Param Miner tool. In 2023 he presented 'Smashing the State Machine: The True Potential of Web Race Conditions' at DEF CON 31, introducing single-packet attack techniques for reliably triggering race conditions in web applications.

Legacy

Kettle has presented novel research at Black Hat USA for roughly a decade running. Through this combination of original research, widely used open-source tooling, and public education efforts, Kettle is regarded as one of the more influential figures in contemporary web application security research methodology.

Timeline

• 2013-05-01Published early research on practical HTTP Host header attacks and password reset poisoning.
• 2016-11-04Presented 'Backslash Powered Scanning: Hunting Unknown Vulnerability Classes' at Black Hat Europe 2016.
• 2018-08-09Presented 'Practical Web Cache Poisoning' at Black Hat USA 2018, releasing the Param Miner Burp extension.
• 2019-08-07Presented 'HTTP Desync Attacks' at Black Hat USA 2019, popularizing HTTP request smuggling.
• 2019-08-11Repeated the HTTP Desync Attacks talk at DEF CON 27.
• 2020-08-05Presented 'Web Cache Entanglement: Novel Pathways to Poisoning' at Black Hat USA 2020.
• 2021-08-05Presented 'HTTP/2: The Sequel is Always Worse' at Black Hat USA 2021.
• 2023-08-12Presented 'Smashing the State Machine: The True Potential of Web Race Conditions' at DEF CON 31.