HTTP Terminator Reveals New Attack Techniques in Cybersecurity Research

• •HTTP Terminator identified 700 vulnerable sites, showcasing a new class of vulnerability.
• •The research demonstrated the critical role of human oversight in AI-driven cybersecurity.
• •James Kettle's work emphasizes the potential for AI to generate new attack techniques.

PortSwigger's HTTP Terminator, developed by James Kettle, identified hundreds of websites vulnerable to HTTP request smuggling, confirming around 700 vulnerable targets. The system autonomously generated and tested 30,000 unique attack vectors, revealing a new vulnerability class called 'shared-parser confusion.' While capable of running autonomously, the research showed that human input significantly enhanced the discovery process. The findings have implications for critical infrastructure, financial institutions, and enterprise products. The research emphasizes the importance of human expertise in AI-driven security research, making the HTTP Terminator's source code available for other researchers. The system's results were presented at Black Hat USA, highlighting the blend of automated and human-guided research.