AI-assisted research pipeline that extracts HTTP desync techniques, generates malformed request test-cases, validates them via Burp, and confirms request-smuggling exploits.
An AI-assisted research pipeline for discovering and exploiting HTTP request-smuggling / response-desynchronisation vulnerabilities. Published as a reference companion to the research; parts are runnable (see the matrix below).
URL / RFC ──▶ seeker ──▶ flamer ──▶ validator ──▶ investigator
extract generate validate exploit /
desync malformed against a confirm /
vectors test-cases target (Burp) report
| Stage | Language | Role |
|---|
seeker/ | Python | Extract desync techniques from docs/RFCs via Claude |
flamer/ | Java/Gradle | Generate malformed HTTP test-cases from those techniques |
validator/ | Java/Gradle | Burp extension that validates generated requests against a target |
investigator/ | Python | Replicate, confirm, cascade and report on findings |
| Stage | Runs with | Status |
|---|---|---|
| seeker | Python 3.11+ + ANTHROPIC_API_KEY | ✅ self-contained |
| flamer | Java 21 + Gradle + ANTHROPIC_API_KEY | ✅ self-contained |
| validator | Java 21 + Gradle + Burp Suite (commercial) + bulkScan (see validator/README) | ⚠️ needs Burp |
| investigator | Claude Code + external MCP simulator + Burp Organizer + a target | ⚠️ needs external pieces (see its README) |
Each subdir has its own README with setup and commands.
The pipeline's SQLite databases (seeker.db, flamer's production.db /
model_outputs.db, investigator's investigations.db) are not included in
this repository — they're gitignored and get regenerated by running each
stage.
These tools find and exploit real vulnerabilities. Only run them against systems you own or are explicitly authorised to test. No real target data is included in this repository.
AGPL-3.0 — see LICENSE.