/multipart
well-formed multipart/form-data response — declared boundary matches body delimiter, every part has a single Content-Disposition name= parameter, closing boundary has trailing CRLF, no nested multipart.
chaos.catastrophic.ioGET /multipart
Returns a multipart/form-data response with RFC 7578 parser-adversity. Default declares one boundary in the Content-Type and uses a different one in the body. Use ?mode= to isolate other violations: missing terminating CRLF, ambiguous Content-Disposition `name=` parameters, or nested multipart bodies.
boundary-mismatch
trailing-crlf-confusion
disposition-name-injection
nested-multipartnot.catastrophic.ioGET /multipart
well-formed multipart/form-data response — declared boundary matches body delimiter, every part has a single Content-Disposition name= parameter, closing boundary has trailing CRLF, no nested multipart.
Build against not.catastrophic.io/multipart, then
flip the hostname to chaos.catastrophic.io to exercise the chaos.