You can basically add as many or as few bytes as you like, by abusing the chunk-extension in chunked encoding: http://tools.ietf.org/html/rfc2616#section-3.6.1

You can basically add as many or as few bytes as you like, by abusing the chunk-extension in chunked encoding: http://tools.ietf.org/html/rfc2616#section-3.6.1 http://tools.ietf.org/html/rfc2616#section-3.6.1 So you could make all http responses round into 128 byte chunks, by appending 1 to 128 bytes at the end of every response. Effectively it gives you length hiding at an http layer; Still attackable.