[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fXmyju-up-oIEKf5qMc6OEbyazwvm8PIJGAca2-l28jE":3},{"article":4,"iocs":49,"watch_terms":50,"solutions":51,"lesson":112},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":31},"e19b542a-3a10-429e-bf15-fe2aeec0130b","'HTTP Terminator' Hunts for Novel Desync Attacks","http-terminator-hunts-for-novel-desync-attacks-655861","James Kettle of PortSwigger talks with the Dark Reading News Desk about his AI-powered open source tool, which found new HTTP request-smuggling techniques.","James Kettle from PortSwigger has developed an open-source, AI-powered tool named 'HTTP Terminator' that identifies new methods for HTTP request smuggling. This tool aims to help security professionals discover and defend against these sophisticated web application vulnerabilities.","New AI tool 'HTTP Terminator' discovers novel HTTP request-smuggling techniques.","https:\u002F\u002Fwww.darkreading.com\u002Fapplication-security\u002Fhttp-terminator-hunts-novel-desync-attacks","https:\u002F\u002Feu-images.contentstack.com\u002Fv3\u002Fassets\u002Fblt6d90778a997de1cd\u002Fblt23656fc5f4eecff8\u002F6a8f5fe500c0a24f20a52813\u002Fkettle.jpg?width=720&quality=80&disable=upscale","2026-08-26T19:54:34+00:00","2026-08-27T14:00:41.046502+00:00",8,[17,20,23],{"name":18,"type":19},"HTTP Terminator","product",{"name":21,"type":22},"PortSwigger","vendor",{"name":24,"type":25},"HTTP request smuggling","technology","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":26,"icon":28,"name":29,"slug":30},null,"Vulnerabilities","vulnerabilities",[32,37,39,44],{"category":33},{"id":34,"icon":28,"name":35,"slug":36},"02371804-cf6d-4449-98de-f1a2d4d9b266","Tools","tools",{"category":38},{"id":26,"icon":28,"name":29,"slug":30},{"category":40},{"id":41,"icon":28,"name":42,"slug":43},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",{"category":45},{"id":46,"icon":28,"name":47,"slug":48},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[21,18],{"controls":52,"vendors":111},[53,82],{"slug":54,"name":55,"problem":56,"products":57},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[58,66,74],{"vendor_slug":59,"vendor_name":60,"vendor_logo":61,"product_slug":62,"product_name":63,"url":64,"description":65},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"slug":83,"name":84,"problem":85,"products":86},"waf-ddos","Web application firewall and DDoS protection","Websites and APIs stay up, and common web attacks are filtered before they reach them.",[87,95,103],{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-waf","Cloudflare WAF and DDoS protection","https:\u002F\u002Fwww.cloudflare.com\u002Fproducts\u002Fwaf\u002F","Web application firewall and unmetered DDoS mitigation for websites and APIs.",{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"imperva","Imperva","\u002Fvendor-logos\u002Fimperva.png","imperva-cloud-waf","Imperva Cloud WAF","https:\u002F\u002Fwww.imperva.com\u002Fproducts\u002Fweb-application-firewall-waf\u002F","Cloud web application firewall with DDoS and bot protection.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"f5","F5","\u002Fvendor-logos\u002Ff5.png","web-app-and-api-protection","F5 Web App and API Protection","https:\u002F\u002Fwww.f5.com\u002Fsolutions\u002Fweb-app-and-api-protection","Web application firewall, API security, bot management and DDoS mitigation, as a service or self-managed.",[],{"slug":113,"title":114,"body":115,"framework_refs":116,"framework_notes":126},"ai-powered-tool-exposes-new-http-request-smuggling-attack-vectors","AI-Powered Tool Exposes New HTTP Request Smuggling Attack Vectors","HTTP request smuggling (desync) attacks exploit inconsistencies in how front-end and back-end servers parse HTTP requests, allowing attackers to bypass security controls, hijack sessions, or poison caches. The development of 'HTTP Terminator' highlights that novel desync vulnerabilities remain largely undiscovered in production environments due to the complexity of HTTP parsing edge cases. Many organizations run web infrastructure with mismatched or poorly configured HTTP handling between proxies, load balancers, and application servers — a configuration risk that is difficult to detect without specialized tooling. This matters because a successful desync attack can silently compromise entire web applications, affecting all users sharing a connection pipeline. Proactive use of tools like HTTP Terminator is essential to surface these hidden vulnerabilities before malicious actors do.",[117,118,119,120,121,122,123,124,125],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 16: Application Software Security","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 CM-6: Configuration Settings","NIST SP 800-53 RA-5: Vulnerability Monitoring and Scanning","OWASP Testing Guide: OTG-INPVAL-022 HTTP Request Smuggling","NIST SP 800-115: Technical Guide to Information Security Testing","ITIL: Vulnerability and Patch Management Practice",{}]