github.comrepoPortSwigger/http-terminator
http-terminator is PortSwigger's AI-assisted research pipeline for finding and exploiting HTTP request-smuggling and response-desynchronization vulnerabilities. It chains four stages: seeker extracts desync vectors from RFCs and URLs, flamer generates malformed test cases, validator checks candidates against a live target via Burp Suite, and investigator exploits, confirms, and reports findings. Released under AGPL-3.0 as a reference companion to the underlying research, with explicit warnings to only run against authorized targets.
TL;DR PortSwigger AI pipeline that discovers and exploits HTTP request-smuggling and desync bugs via Burp Suite.
Technologies named here
- HTTP Terminator
- seeker
- flamer
- validator
- investigator
- Burp
- Burp Suite
- SQLite
Techniques named here
- HTTP request smuggling
- Response desynchronisation
Related in AppSec
github.comadvisoryFlowise MCP Security Bypass Enables RCE
huntress.comwriteupInside an Oracle Database SQL Injection Attack | Huntress
github.comrepoOASIS
blog.trailofbits.comwriteup