Every field in an HTTP message is a control surface or a leak.

The RFC flags this field itself. Because host and port act as an application-level routing mechanism, §7.2 calls Host "a frequent target for malware seeking to poison a shared cache or redirect a request to an unintended server", and singles out interception proxies that route or build cache keys from it without first verifying that the intercepted connection targets a valid address for that host. Duplicate Host lines, a trusted port suffix, and an internal name sent to the public address are the standard probes.

§7.2 requires a user agent to generate Host unless it sends that information as an :authority pseudo-header, but 9110 does not adjudicate what happens when a message carries both and they disagree. Translation layers between an h2 front end and an h1 back end have to invent an answer, and the answers they invent differ.

Free reconnaissance. Via exposes the proxy stack, often with software names and versions, which narrows a desync technique to the software combination actually sitting in front of the origin. §9.3.8 points at Via as the field of particular interest in a TRACE response for the same reason.

Decrementing Max-Forwards on a TRACE fingerprints how many hops sit between you and the origin, mapping internal topology from outside. The RFC describes this as a diagnostic; it works identically as reconnaissance.

Media-type confusion is the whole game. Send JSON to an endpoint expecting form encoding, or the reverse, to sidestep filters that only pattern-match one type. Charset parameters have historically enabled encoding-based filter bypasses on legacy parsers.

The 9110 hook for smuggling is §5.4, and it is normative: a server that receives a field line, field value, or set of fields larger than it wishes to process MUST respond with an appropriate 4xx, because "Ignoring such header fields would increase the server's vulnerability to request smuggling attacks". Silently truncating instead of rejecting is a violation with a consequence the RFC names.

This is the field behind §17.6, Attacks Using Shared-Dictionary Compression. Compressing attacker-influenced content alongside a secret in one response leaks the secret through response-size deltas, which is the BREACH and CRIME family.

Divergence between the requested URI and Content-Location can expose internal routing or rewrite rules and backend host names that are not otherwise visible.

§17.14 names an entity-tag abuse directly, and it is a privacy attack rather than an enumeration one. A site can construct a semantically invalid entity tag unique to a user, send it in a cacheable response with a long freshness time, and read it back from later conditional requests as a persistent identifier for as long as the user agent keeps the cache entry.

Passive intelligence on deployment cadence and on whether a resource is static or generated. Paired with If-Modified-Since it becomes a 200-versus-304 signal for confirming that a resource exists even when its content is withheld.

§8.8.1 says strong validators are what make lost-update avoidance work. An application that never sends or never enforces If-Match on PUT and DELETE has no lost-update protection at all, so a concurrency race can be forced deliberately against a transfer or a balance update.

A 200-versus-304 difference on a resource you should not be able to enumerate is a confirmation signal, particularly on endpoints whose access control lives at the rendering layer rather than the data layer.

The same signal class as the entity-tag preconditions, but reachable even when the application never emits an ETag, because something in the stack usually supplies a Last-Modified.

The degradation is the point. Where partial-content and full-content handling take different code paths with different access checks, a deliberately stale validator forces the full-response path.

§17.15 is titled Denial-of-Service Attacks Using Range and states the asymmetry outright: the effort required to request many overlapping ranges of the same data is tiny compared with the time, memory, and bandwidth consumed serving them. The RFC adds that multipart range requests are not designed to support random access.

Tells you whether the §17.15 surface exists on a given endpoint before you spend time on it.

The complete-length field discloses the true size of a representation even when you are only permitted a single byte of it, which is enough to confirm that a file exists and how large it is.

Framework-level negotiation has repeatedly shipped format-confusion bugs, where asking for a format the documented API never advertises reaches a different and less hardened parser. Undocumented negotiated formats are unauthenticated attack surface.

Controls whether the §17.6 compression side channel can be triggered at all, which makes forcing or withholding compression a prerequisite step rather than the attack itself.

§17.13 singles this field out beyond fingerprinting: the RFC observes that understanding a given language set might be strongly correlated to membership in a particular ethnic group, and suggests user agents omit it except for sites the user has permitted. Separately, localisation pipelines that build a template or file path out of the value have shipped traversal bugs.

A missing or incomplete Vary is the usual root cause of cache poisoning: when a response depends on an input the cache does not key on, one poisoned entry serves every later visitor. §12.5.5 gives caches a MUST NOT that depends on Vary, and gives origin servers only a SHOULD to generate it.

Realm strings and scheme lists are reconnaissance. They usually reveal which authentication backend is in play, and the realm value sometimes carries an internal host name.

§17.16.1 states that HTTP defines no single mechanism for keeping credentials confidential, that the framework is inadequate for existing schemes providing no confidentiality of their own, and that services depending on individual user authentication require a secured connection before credentials are exchanged. The practical test is whether the field survives a redirect to a different origin.

Confusing proxy-scoped credentials with origin-scoped credentials is a real disclosure class. A Proxy-Authorization value forwarded past the proxy to the origin, or the reverse, hands credentials to a party that was never meant to see them.

Scanners often miss it because it only appears on success, which makes its presence or absence a cheap way to tell a genuinely authenticated request from one that was merely syntactically accepted.

§10.1.3 requires a user agent to leave out the fragment and userinfo components, and nothing more. Everything else in the URI, query string included, travels to whatever third-party resource the page loads. §17.9 connects the two, noting that the field can reveal the immediate browsing history of the user and any personal information in the referring URI.

§17.13 says the field might contain enough information to uniquely identify a specific device when combined with other characteristics, particularly where the agent volunteers excessive detail about the system or its extensions. Offensively, the more interesting case is a backend that makes authorization or feature-flag decisions on the string, which is a soft access-control bypass.

Divergent handling of 100-continue between a front-end proxy and a back-end origin is a known desync amplifier, because one hop may buffer the whole body while the other waits for an interim response.

Rarely an attack vector. Worth knowing because §17.13 calls From the most obvious fingerprinting field in HTTP, which makes a populated From on inbound traffic a useful attribution signal when you are on the defending side.

A server-side fetcher that follows redirects turns an open redirect into full SSRF, defeating allow-list checks that only validate the first hop. 9110 defines what Location means and says nothing about whether a fetcher should follow it, which is why every URL-consuming feature answers differently.

Mandatory on a 405 and permitted anywhere else, which makes method enumeration free even when OPTIONS is filtered at the edge. A proxy MUST NOT modify the field, so what you receive is what the origin generated.

On rate-limit responses, the precision of the value can leak queue internals, and inconsistent values across endpoints help map which services share a limiter.

§17.12, Disclosure of Product Information, is the framing the RFC itself uses: a version string is a direct path to a vulnerability database. The first field worth logging in any reconnaissance pass.