infrastructure-and-protocol

name	infrastructure-and-protocol
description	HTTP/2/3 protocol attacks, TLS/security-header audits, WebSocket transport issues, cache poisoning/deception, exposed container/orchestration surfaces (K8s/Docker), serverless misconfig, and log-poisoning-to-RCE. Converted from master-pentest-prompt.md Phase 12. Use during infrastructure-level recon on any target, especially ones fronted by a proxy/CDN or running on Kubernetes/serverless.

Infrastructure & protocol

When to use

Infrastructure-level testing on any target -- protocol behavior, TLS config, caching layer, and container/orchestration exposure are worth checking regardless of the application layer above them.

Protocol-level

• HTTP/2 current attacks: downgrade, rapid reset, HPACK-related issues.
• HTTP/3/QUIC behaviors and proxy bypass.
• TLS: weak ciphers, full SSL Labs-style checks, missing HSTS, mixed content, certificate issues, CN/SAN mismatches.
• Security headers audit: CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP/COEP.
• WebSocket over ws:// (insecure transport), missing auth on the upgrade.

Cache

Cache key manipulation, cache poisoning, web cache deception (path rules, appending .css/other static extensions to a dynamic endpoint so the cache treats it as static), PURGE verb abuse.

Container / orchestration exposure

• K8s/Docker: exposed 2375/6443, privileged containers, exposed Docker socket, service-account token readable inside a pod, exposed dashboard, exposed etcd on 2379.
• Serverless: Lambda environment variables, IAM role reuse, the Denonia-class of serverless-specific malware/misconfig patterns.

Log poisoning

Log poisoning escalating to LFI, cron-based RCE, or exposure of debug/admin consoles reachable through poisoned log content.