The HTTP Garden – A Parser Vulnerability Research Tool
I wrote this tool during an internship at Narf Industries in 2023. It's a REPL that allows for quickly developing, testing, and fuzzing for HTTP request smuggling attack payloads. I started the internship having never worked with web servers, and have now found over 100 HTTP implementation bugs. I attribute this mostly to the ease of experimentation in the Garden. REPL-oriented fuzzing is just a really good interface for finding parsing bugs. It's pretty neat to able to run a differential fuzzer, categorize and display all the discovered discrepancies, then let a human pick through them and…
The HTTP Garden – A Parser Vulnerability Research Tool launched on February 5, 2024 with 75 votes, #833 of 3,962 launches that month and more than 90% of that year's launches. The site was still online in September 2026, 2 years on.
In plain words
The HTTP Garden is a REPL tool for developing, testing, and fuzzing HTTP request smuggling payloads. Built during a 2023 internship at Narf Industries, it enables researchers to quickly experiment with HTTP parsing vulnerabilities through an interactive interface. The tool includes a differential fuzzer that discovers discrepancies between server implementations, displays them for human review, and allows testing for exploitability. It was used to identify over 100 HTTP implementation bugs across various server combinations including Google Cloud, Akamai, Node.js, LiteSpeed, and OpenBSD relayd.
written from the facts on this page · September 2026
From the sources
Differential testing framework for HTTP implementations - narfindustries/http-garden
In the maker’s words, at launch
I wrote this tool during an internship at Narf Industries in 2023. It's a REPL that allows for quickly developing, testing, and fuzzing for HTTP request smuggling attack payloads. I started the internship having never worked with web servers, and have now found over 100 HTTP implementation bugs. I attribute this…
Does a similar job
all alternatives →
HTTP Mock – Intercept, debug and mock HTTP(S) with zero setup2019 · httptoolkit.tech · ▲341Beautiful, cross-platform & open-source tools for debugging, testing and building with HTTP(S), on Windows, Linux & Mac.
Needle: We Distilled Gemini Tool Calling into a 26M ModelMay 2026 · github.com · ▲776Hey HN, Henry here from Cactus. We open-sourced Needle, a 26M parameter function-calling (tool use) model. It runs at 6000 tok/s prefill and 1200 tok/s decode on consumer devices. We were always frustrated by the little effort made towards building agentic models that run on budget phones, so we conducted investigations that led to an observation: agentic experiences are built upon tool calling, and massive models are overkill for it. Tool calling is fundamentally retrieval-and-assembly (match query to tool name, extract argument values, emit JSON), not reasoning. Cross-attention…
ZeroHTTPd: A web server to teach Linux performance, with benchmarks2019 · unixism.net · ▲472Articles in this series Part I. Iterative ServersPart II. Forking ServersPart III. Pre-forking ServersPart IV. Threaded ServersPart V. Pre-threaded ServersPart VI: poll-based serverPart VII: epoll-…
Hurl – Run and test HTTP requests with plain text, curl and Rust2021 · hurl.dev · ▲223Hurl, run and test HTTP requests with plain text and curl. Hurl can run fast automated integration tests.
- DRDontBeEvil.rip: Search, for developers (API, expressions, CLI)2022 · ▲269
I'd like to invite everyone to try out DontBeEvil.rip, an experimental search engine for developers. tl;dr $ alias rip="curl -G -H 'Accept: text/plain' --url https://dontbeevil.rip/search --data-urlencode " $ rip 'q=Heartbleed bug' DontBeEvil.rip is a year long experiment to see if a small team can build a developer-focused search engine that is self-sustaining on $10 monthly subscriptions. It works by only indexing high-quality resources that are relevant to developers. You won't get useless listicles because we'll never crawl them. Relevant urls are harvested from HN,…
Pfuzz, a web fuzzer following the Unix philosophy2024 · github.com · ▲93I recently dipped my toes into bug bounty hunting and finding security flaws in web applications. As a friend of UNIX shells I was building a repertoire of command line tools to make and analyze HTTP requests. Fortunately there are already many suitable tools like curl, jq, different fuzzers and some really nice tools for specific tasks by Tom Hudson [1]. However, I disliked that the existing fuzzers were monoliths where I had no easy way of creating custom behavior or analyses. They commonly do a multitude of things: Create multiple requests using one or more wordlist, sending the request,…
More dev tools this month
the category →
open-source IDE for thoughtful software design. Contribute to devdotfast/whiteboard development by creating an account on GitHub.
Dev tools · 27d ago · github.com
Contribute to reladraw/reladraw development by creating an account on GitHub.
Dev tools · 25d ago · github.com
OpenBot▲362Grok Bot alternative: free, local, open-source, multiplayer
Dev tools · 22d ago · openbot.run
Talanoa▲341Hi HN, I’m a fullstack developer, and honestly, I’ve lost count of how many side projects I’ve worked on over the years. But one idea kept coming back to me: a different kind of email client. It first came to me in 2014: “What if we could handle emails more like conversations?” Every year, I’d revisit this concept in my “Build Notes.” Ten years later, no one had built exactly what I had in mind — so I finally decided to do it myself. That’s how Talanoa was born. I wanted something focused on people, not timelines. I was tired of marking messages as unread just to remember to reply later, or…
Dev tools · 20d ago · talanoa.email
CoreSpeed▲332One MCP for everything your agents need: apps, memory, tools
Dev tools · 27d ago · corespeed.io
Source: Show HN post ↗ · launch text quoted in part
Launched alongside, February 2024
the whole month →
MarketingIdeas.com▲1,230Never run out of marketing ideas ever again
Growth · 2024 · marketingideas.com
