Making HTTP header injection critical with one prompt

* A new scan check for HTTP Request Header Injection has been introduced.
* The exploitation methodology for CRLF-Powered Desync Attacks has been distilled into Burp AT skills.
* The process involves determining header insertion points relative to existing host headers to achieve request splitting.
* Payloads are constructed using prefixes like GET /%0d%0a%0d%0aGET%20/%20HTTP/13.37%0d%0aHost:%20example.com%0d%0aContent-Length:%20150%0d%0a%0d%0a HTTP/1.1 to induce desyncs.
* The process includes a mini-crawl to find open redirects using headers like Host or X-Forwarded-Host.
* An exploit attempts to combine request structures with host header manipulation to force redirects to an attacker's domain.
* Skills include fail points, such as fallback skills for blind request tunnelling if full desync fails.

The narrative focuses on the practical application and automation of complex attack methodologies, shifting critical vulnerability research from manual documentation to automated skill execution within Burp AT. This move aims to accelerate tester discovery by embedding the methodology into the testing tool itself, suggesting a paradigm where novel attack vectors are immediately translated into actionable, autonomous capabilities. The emphasis on safety measures, such as fallback skills and fail points, indicates an awareness of the risk associated with highly potent exploitation techniques, positioning the research not just as a demonstration of capability but as responsible, albeit high-impact, education for testers. The inclusion of specific edge cases, like blind request tunnelling, suggests an understanding that successful exploitation is not monolithic; it requires anticipating and mitigating evasion techniques. The implication for cognitive sovereignty lies in recognizing that cutting-edge security knowledge is being rapidly modularized and operationalized, which requires a critical assessment of who controls the deployment of these automated skills and what oversight remains over their application in real engagements.
Bridge questions: How does the automation of complex attack chains affect the development curve for defensive security practices? What are the long-term implications for the distinction between vulnerability research and exploitation knowledge transfer? Should autonomous execution of high-risk exploits be prioritized, or should human verification remain the ultimate gate?