http-terminator

An AI-assisted research pipeline for discovering and exploiting HTTP request-smuggling / response-desynchronisation vulnerabilities. Published as a reference companion to the research; parts are runnable (see the matrix below).

The pipeline

URL / RFC  ──▶  seeker  ──▶  flamer  ──▶  validator  ──▶  investigator
              extract       generate      validate         exploit /
              desync        malformed     against a        confirm /
              vectors       test-cases    target (Burp)    report

Stage	Language	Role
seeker/	Python	Extract desync techniques from docs/RFCs via Claude
flamer/	Java/Gradle	Generate malformed HTTP test-cases from those techniques
validator/	Java/Gradle	Burp extension that validates generated requests against a target
investigator/	Python	Replicate, confirm, cascade and report on findings

Runnability

Stage	Runs with	Status
seeker	Python 3.11+ + ANTHROPIC_API_KEY	✅ self-contained
flamer	Java 21 + Gradle + ANTHROPIC_API_KEY	✅ self-contained
validator	Java 21 + Gradle + Burp Suite (commercial) + bulkScan (see validator/README)	⚠️ needs Burp
investigator	Claude Code + external MCP simulator + Burp Organizer + a target	⚠️ needs external pieces (see its README)

Each subdir has its own README with setup and commands.

Data

The pipeline's SQLite databases (seeker.db, flamer's production.db / model_outputs.db, investigator's investigations.db) are not included in this repository — they're gitignored and get regenerated by running each stage.

Ethics & authorisation

These tools find and exploit real vulnerabilities. Only run them against systems you own or are explicitly authorised to test. No real target data is included in this repository.

License

AGPL-3.0 — see LICENSE.