Can AI Do Novel Security Research? Meet the HTTP Terminator

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://portswigger.net/research/http-terminator
• Blog Title: Can AI Do Novel Security Research? Meet the HTTP Terminator
• Suggested Section: Pentesting Web > HTTP Request Smuggling / HTTP Desync Attack, with cross-references to HTTP Response Smuggling / Desync and AI > AI-Assisted Fuzzing and Vulnerability Discovery

🎯 Content Summary

Overview

HTTP Terminator is an open-source autonomous security-research system created by James Kettle to generate, evaluate, weaponize, and recursively expand novel HTTP desynchronization techniques. It split 138 HTTP and SMTP RFCs into approximately 15,000 fragments of one to three sentences, used those fragments to generate about 30,000 normalized vectors, and continuously evaluated them against 30,000 authorized bug-bounty and vulnerability-disclosure-program targets. The evaluato...

🔧 Technical Details

Protocol-ruler transformation detection: Determine the exact header-size boundary at which a back-end switches from accepting to rejecting a request. Replace known bytes with a candidate sequence and repeat the boundary search. A shifted limit reveals whether a front-end expanded, deleted, normalized, or rewrote the sequence and approximately how many bytes the transformation added or removed. This identifies Unicode/mojibake transformations, header deletion, overriding, and IP-header rewriting without requiring reflection.

Generic cross-request contamination detection: Record a victim request with a stable response, send a candidate trigger through another front-end connection, and repeat the victim request. A reproducible response change indicates broken request isolation. Classify the behavior by embedding recognizable requests such as GET / HTTP/777 or TRACE in the apparent body and checking whether a later victim receives the...

🤖 Agent Actions

Using tool discovery first to find the repo/file inspection command set and any repo-editing helpers needed for this HackTricks update.
I’m scanning the repo for HTTP desync/request smuggling and AI-related pages, then I’ll read several candidate files to pick the single best page to update.
Reading the main candidate pages now—HTTP smuggling/desync and the existing AI-assisted fuzzing page—to identify the best single file to extend without duplicating existing material.
I’ve picked the main HTTP Request Smuggling / HTTP Desync Attack page as the single update target. Next I’m locating the right insertion points and the existing references so I can add only the genuinely new techniques.
I’ve drafted concise additions around: newer detection methodology, protocol-ruler transformation testing, non-classic 2026 trigger families, and dangling-byte RQP. I’m applying them to the main HTTP desync page now.
I’ve applied the changes. Now I’m re-reading the modified sections and checking the diff to ensure the content landed cleanly in one file with correct citations and placement.
Updated src/pentesting-web/http-request-smuggling/README.md.

Added:

• new 2026 trigger families:
  • HTTP/1.0 + Transfer-Encoding
  • multipart/byteranges / Shared-Parser Confusion
  • dual-matching Content-Length
  • CONNECT tunnel confusion
• new detection methodology:
  • generic cross-request contamination detection
  • clean vs dirty probes
  • protocol-ruler transformation detection
• new weaponization note:
  • dangling-byte Response Queue Poisoning
• cross-reference to:
  • existing HTTP Response Smuggling / Desync page
  • existing AI-Assisted Fuzzing & Automated Vulnerability Discovery page
• appended numbered reference:
  • [22] PortSwigger’s HTTP Terminator research post

Verified with git diff that only this single file was changed.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://portswigger.net/research/http-terminator

Content Categories: Based on the analysis, this content was categorized under "Pentesting Web > HTTP Request Smuggling / HTTP Desync Attack, with cross-references to HTTP Response Smuggling / Desync and AI > AI-Assisted Fuzzing and Vulnerability Discovery".

Repository Maintenance:

• MD Files Formatting: 990 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0