The HTTP Garden – A Parser Vulnerability Research Tool
I wrote this tool during an internship at Narf Industries in 2023. It's a REPL that allows for quickly developing, testing, and fuzzing for HTTP request smuggling attack payloads. I started the internship having never worked with web servers, and have now found over 100 HTTP implementation bugs. I attribute this mostly to the ease of experimentation in the Garden. REPL-oriented fuzzing is just a really good interface for finding parsing bugs. It's pretty neat to able to run a differential fuzzer, categorize and display all the discovered discrepancies, then let a human pick through them and…
In plain words
The HTTP Garden is a REPL tool for developing, testing, and fuzzing HTTP request smuggling payloads. Built during a 2023 internship at Narf Industries, it enables researchers to quickly experiment with HTTP parsing vulnerabilities through an interactive interface. The tool includes a differential fuzzer that discovers discrepancies between server implementations, displays them for human review, and allows testing for exploitability. It was used to identify over 100 HTTP implementation bugs across various server combinations including Google Cloud, Akamai, Node.js, LiteSpeed, and OpenBSD relayd.
written from the facts on this page · September 2026
From the sources
In the maker’s words, at launch
I wrote this tool during an internship at Narf Industries in 2023. It's a REPL that allows for quickly developing, testing, and fuzzing for HTTP request smuggling attack payloads. I started the internship having never worked with web servers, and have now found over 100 HTTP implementation bugs. I attribute this mostly to the ease of experimentation in the Garden. REPL-oriented fuzzing is just a really good interface for finding parsing bugs. It's pretty neat to able to run a differential fuzzer, categorize and display all the discovered discrepancies, then let a human pick through them and interact with fuzz targets to test whether the bugs are exploitable. Some notable server combinations in which we discovered new request smuggling attacks include Google Cloud <-> Node.js, Akamai <-> Node.js, [almost anything] <-> LiteSpeed, and OpenBSD relayd <-> [anything]. We also found an infinite loop DoS in Cesanta Mongoose that affects all configurations, and a null pointer dereference that can crash any OpenBSD httpd server that uses FastCGI.
More dev tools this month
the category →
Open-source GTM skills for technical founders
Dev tools · 29d ago · gtmcofounder.com
OpenTrailPaper is open-source bike computer firmware for the LilyGO T5S3 4.7" E-Paper PRO. It supports offline maps, GPX routes, FIT recording and Bluetooth sensors.
Dev tools · 1d ago · opentrailpaper.com
Launched alongside, February 2024
the whole month →
MarketingIdeas.com▲1,230Never run out of marketing ideas ever again
Growth · 2024 · marketingideas.com
