Can AI Do Novel Security Research? Meet the HTTP Terminator

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://portswigger.net/research/can-ai-do-novel-security-research
• Blog Title: Can AI Do Novel Security Research? Meet the HTTP Terminator
• Suggested Section: Pentesting Web > HTTP Request Smuggling / HTTP Desync Attack, with subsections for protocol-ruler transformation detection, generic contamination detection, dangling-byte response queue poisoning, shared-parser confusion, novel framing probes, and anomaly-driven discovery; optionally cross-reference Generic Methodologies > AI-assisted fuzzing and vulnerability discovery

🎯 Content Summary

Overview

James Kettle presents HTTP Terminator, an open-source autonomous security-research system designed to invent, evaluate, weaponize, and recursively expand novel HTTP desynchronization techniques. The system converted 138 HTTP and SMTP RFCs into approximately 15,000 micro-inspiration fragments, generated roughly 30,000 normalized unique probes, and continuously evaluated them against 30,000 websites where testing was authorized through bug-bounty programs or vu...

🔧 Technical Details

Protocol-ruler transformation detection: Determine the exact request-header size where a back end changes its response, then substitute candidate bytes near that boundary. A change in the maximum accepted filler length measures whether and by how many bytes a front end expands, removes, replaces, or normalizes the sequence. This can reveal Unicode/mojibake conversion, spoofing-header rewriting, header deletion, and other hidden transformations that may create parser disagreement.

RFC micro-inspiration: Split protocol specifications into one-to-three-sentence fragments and generate a small number of testable state-machine, buffering, or connection probes from each fragment. Avoid naming the expected vulnerability class, normalize duplicates, and validate every vector against realistic deployments. Small inspiration fragments reduce model anchoring and produce more diverse hypotheses than repeatedly using one broad prompt.

Generic ...

🤖 Agent Actions

Updated src/pentesting-web/http-request-smuggling/README.md.

Added concise, cited content for:

• protocol-ruler transformation detection
• generic cross-request contamination detection
• clean single-request multi-response recon
• 2026 trigger families (HTTP/1.0 + Transfer-Encoding, multipart/byteranges, dual matching Content-Length, CONNECT trailing bytes)
• Shared-Parser Confusion
• dangling-byte response queue poisoning
• anomaly-driven discovery

Also appended reference [22] to the August 5, 2026 PortSwigger research post.

Verification:

• Checked the inserted sections and citation usage in-file.
• mdbook build could not be run because mdbook is not installed in this environment.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://portswigger.net/research/can-ai-do-novel-security-research

Content Categories: Based on the analysis, this content was categorized under "Pentesting Web > HTTP Request Smuggling / HTTP Desync Attack, with subsections for protocol-ruler transformation detection, generic contamination detection, dangling-byte response queue poisoning, shared-parser confusion, novel framing probes, and anomaly-driven discovery; optionally cross-reference Generic Methodologies > AI-assisted fuzzing and vulnerability discovery".

Repository Maintenance:

• MD Files Formatting: 990 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0