Apache HTTP Path Confusion Notes (CVE-2021-41773 Class)
Lab Apache Alias map: raw vs normalized paths as text, Require/Alias mismatch, 403/404 artifacts — no working traversal into /etc.
Http
HTTP Request Smuggling: A Defender Mental Model
Lab walkthrough of HTTP/1.1 framing disagreement: raw frames, nginx vs Python http.server parse notes, sanitized logs, hop-boundary hardening.