AI-Assisted HTTP Terminator Finds Novel HTTP Desync Techniques and Apache Zero-Day
According to PortSwigger, after examining 30,000 potential attack vectors, James Kettle's artificial intelligence (AI)-assisted research system HTTP Terminator produced and demonstrated new HTTP desynchronization approaches.
According to PortSwigger, a different human-guided discovery cascade also revealed an Apache Traffic Server zero-day. According to Kettle, HTTP Terminator identified about 700 susceptible targets prior to further validation and RQP research after testing 30,000 domains where scanning was permitted thru bug bounty or vulnerability disclosure programs.
According to Kettle, those discoveries included an airport, banks, government infrastructure, and security devices.
New desync triggers, a dual-matching Content-Length pattern, and a "dangling-byte" approach were...