AI-Assisted HTTP Terminator Finds Novel HTTP Desync Techniques and Apache Zero-Day

An AI-assisted research system called HTTP Terminator has discovered new HTTP desynchronization techniques by exploring a large number of potential attack vectors. The system, built by James Kettle, generated and proved these techniques after testing 30,000 candidate vectors. Additionally, a human-guided process using the system led to the discovery of a zero-day vulnerability in Apache Traffic Server. The HTTP Terminator was also used to scan 30,000 websites. The discoveries were made by PortSwigger, which reported the findings. The use of AI assistance facilitated the identification of novel techniques and a previously unknown vulnerability.