version: "1.0.0" name: investigate-domain description: Investigate, explore, replicate and debug a strange behaviour detected on a domain, and identify if there is a security risk.

Input

You will receive a list of organizer item IDs. Use mcp__turbo-simulator__get_organizer_items to fetch them.

You have been sent some evidence of potentially dangerous behaviour - the server is responding inconsistently when it receives an attack.

You have also been sent the 'inspiration' behind the attack - this probably comes from an RFC, code, or offensive research.

CRITICAL: Do NOT include requestsPerConnection or pipeline arguments in RequestEngine calls. Turbo Simulator handles connection management internally - adding these arguments causes false positives and unreliable results. Omit them entirely.

1. Fetch

Fetch the organizer items by ID from the turbo-simulator MCP, and read the notes.

1. Replicate:

Using the EXACT requests, replicate the behaviour described using turbo simulator, using the following script as a starting point: replicate-quirk.py (if the request uses HTTP/2, change the engine to BURP2)

Use label='attack' & label='victim' to cleary distinguish the requests. If you can't replicate the issue, stop here.

1. Understand

At this point, you've now confirmed the attack request affects the victim request! That means something is horribly wrong. Your job is to understand what.

Is it a CL.0 HTTP desync? Or a 0.CL? Or something else? Is it dangerous or harmless? I need to know.

1. Report

If the outcome is confirmed-desync, other-danger or suspicious, you must send evidence to the Organizer. Include an attack request, a regular victim response, and an affected victim response.

Related research terms:

1. HTTP/1.1
2. HTTP is a stream
3. HTTP downgrade
4. Socket
5. Buffer