Can you talk about the HTTP desync attack, right? It took like a request smuggling from a kind of an obscure footnote, right, to a kind of a mainstream attack, right? So how did that research start and what it teach about, you know, finding what everyone else missed?

So that research, it came from two places.

One place is I saw some research published a few years earlier at DEFCON by Regilero called Hiding Wookies in HTTP.

And he was kind of talking about request smuggling, but...

The research made absolutely no sense to me.

And also it was full of warnings like this is way too dangerous to use on live systems.

Like you'll get prosecuted.

Now, let's talk about the future, okay? So if HGP Terminator works, right, and AI, you know, then invents novel research, right? What's the future for the security researcher as a human professional for the next, like, three to five years?

What is the actual nature of the issue here? Why did it allow you to hack a third or more of the internet immediately? And why is it such a prevalent pattern in the way that web apps are built that allows this to happen?

So the issue is that many, many websites still use HTTP 1.1. And it's a super, super old protocol.

And it's text-based.

And it fundamentally was not designed for the kind of complexity of systems that you've got these days.

So if you use HTTP 1.0 and it's just a browser talking to a server, there is zero risk.

But most modern websites now, they've got a front end of some kind, maybe a load balancer, maybe a caching proxy, maybe a CDN, maybe like eight layers like that all talking to each other.

And the problem is with a text-based protocol like HTTP1, it's very easy to send a message that gets interpreted by the systems differently.

Yeah.

So, so tell us what you've been up to.

Absolutely.

So, uh, over the last couple of years, I noticed a lot of people have been trying to ask the question, can AI do pen testing and build things that can do that? Uh, but it seemed like hardly anyone was exploring whether AI can do actual novel research, whether it can come up with new attack techniques that really work, and whether it can do that in a fully autonomous manner.

And, uh, as someone that's been doing research myself for 10 years, I thought, "Well, what if I just take my entire HD DSinc research methodology and build a system that implements it using AI?" Uh, and it works, and the results are absolutely insane, and I'm really psyched to be sharing all about that, uh, at Black Hat USA this August.

Oh, my goodness.

It has so much, it's found so much, that I, I can't handle it all, right? And it, it's push- a- and it, it's this explosion of discoveries, and I'm, I'm putting it out there so the whole community can use it.

But at, my actual core goal with the presentation is to share the blueprint so other researchers can put their methodology and turn it into a autonomous AI system in, with their, with their insights, with their expertise.

Because e- you look, you look, you look at research, every researcher has a different methodology.