portswigger/http-terminator/simplify-vector

Request Simplification

Iteratively simplifies an HTTP request to find the minimal trigger for a behavior.

How to use

1. Copy the template simplify-vector.py
2. Set request_to_simplify to the full request that triggers the behavior
3. Set success_fingerprint to a string that appears in the response ONLY when the behavior triggers
4. Run via turbo simulator MCP

Configuration

request_to_simplify = '''POST /path HTTP/1.1\r\nHost: example.com\r\n...\r\n\r\n'''
success_fingerprint = 'unique-string-in-triggered-response'

Choosing a good fingerprint

The fingerprint must be UNIQUE to the triggered behavior. Bad fingerprints cause over-simplification.

For desync/response concatenation:

• Use text from the FIRST response (e.g., Apache Server from a front-end 400 error)
• Or use something that only appears when both responses are concatenated

Avoid:

• Strings that appear in normal responses (e.g., domain names, app names)
• Generic error messages that appear in multiple error types

Simplification phases

1. Normalise protocol - if HTTP/1.0 or HTTP/2, tries changing to HTTP/1.1
2. Try GET method - if not already GET, tries changing to GET
3. Simplify path - tries changing path to /
4. Remove headers - tries removing each header (except Host)
5. Try canonical values - for each surviving header, tries replacing its value with x, then a normal value for that header; keeps the simplest value that still triggers. Retried (default 3x) so a flaky miss doesn't wrongly mark a value as essential. This reveals when an unusual-looking value (e.g. Content-Type: multipart/byteranges) isn't actually required — something deletion alone can never discover.
6. Remove words - for remaining headers, tries removing words from values
7. Remove characters - tries removing individual characters from values

Output

• kept:* - simplification was kept (fingerprint still present)
• reverted:* - simplification was reverted (fingerprint disappeared)
• FINAL-MINIMAL - the minimal trigger