HTTP/2 protocol-specific attack playbook. Use when the target supports HTTP/2 and you need to exploit binary framing, HPACK compression, h2c upgrade smuggling, pseudo-header injection, stream multiplexing abuse, or H2→H1 downgrade translation flaws.

SKILL: HTTP/2 Specific Attacks — Expert Attack Playbook AI LOAD INSTRUCTION : HTTP/2 protocol level attack techniques beyond basic request smuggling. Covers h2c smuggling, pseudo header manipulation, HPACK attacks, single packet race conditions, and H2→H1 downgrade injection. Base models conflate HTTP/2 smuggling with HTTP/1.1 smuggling — this skill focuses on H2 unique attack surface. 0. RELATED ROUTING [request smuggling](../request smuggling/SKILL.md) — CL.TE/TE.CL/TE.TE fundamentals and H2.CL/H2.TE variants [request smuggling/H2 SMUGGLING VARIANTS.md](../request smuggling/H2 SMUGGLING VARIANTS.md) — byte level H2.CL/H2.TE payloads, CL.0, client side desync [race condition](../race condition/SKILL.md) — single packet attack leverages H2 multiplexing for race conditions [web cache deception](../web cache deception/SKILL.md) — cache poisoning via H2 smuggled responses 1. HTTP/2 ATTACK SURFACE OVERVIEW Feature Attack Surface Binary framing Frame level manipulation, parser differentials HPACK compression Compression oracles (CRIME/BREACH), table poisoning Multiplexing Single packet race conditions, RST STREAM flood Server push Cache poisoning via unsolicited push Pseudo headers ( :method / :path / :authority / :scheme ) Injection, request splitting, path discrepancy 2. h2c (HTTP/2 CLEARTEXT) SMUGGLING 2.1 Concept h2c is HTTP/2 without TLS, negotiated via the HTTP/1.1 Upgrade mechanism. Many reverse proxies forward the Upgrade: h2c header without understanding it, allowing attackers to bypass proxy level access controls. 2.2 Attack Flow 2.3 What You Can Bypass 2.4 Tool: h2csmuggler 2.5 Detection 3. PSEUDO HEADER INJECTION 3.1 HTTP/2 Pseudo Headers HTTP/2 replaces the request line with pseudo headers (prefixed with : ): Pseudo Header HTTP/1.1 Equivalent Example :method Request method GET , POST :path Request URI /api/users :authority Host header target.com :scheme Protocol https 3.2 Path Discrepancy Between Proxy and Backend 3.3 Duplicate Pseudo Header Injection HTTP/2 spec forbids duplicate pseudo headers, but implementation varies: 3.4 Authority vs Host Disagreement 3.5 Scheme Manipulation 4. HPACK COMPRESSION ATTACKS 4.1 CRIME/BREACH on HTTP/2 4.2 Header Table Poisoning 5. STREAM MULTIPLEXING ABUSE 5.1 Single Packet Attack (Race Conditions) HTTP/2 multiplexing allows sending multiple requests in a single TCP packet, achieving true simultaneous server side processing: 5.2 RST STREAM Flood (CVE 2023 44487 "Rapid Reset") 5.3 PRIORITY Manipulation 6. HTTP/2 → HTTP/1.1 DOWNGRADE ISSUES 6.1 Header Injection via Binary Format H2 header values are binary — \r\n is valid data within a value. When proxy downgrades to H1, \r\n in header value becomes actual line break → header injection. 6.2 Transfer Encoding Smuggling H2 spec forbids transfer encoding , but some proxies pass it through during downgrade → backend processes chunked encoding → H2.TE smuggling. See ../request smuggling/H2 SMUGGLING VARIANTS.md . 6.3 Content Length Discrepancy H2 uses frame length (no CL needed). If proxy generates CL during downgrade but attacker also sent a CL header → conflicting lengths → request smuggling. 6.4 Header Name Case H2 requires lowercase. Sending Transfer Encoding (uppercase) is invalid H2 but some proxies pass it → valid H1 header on backend. 7. SERVER PUSH CACHE POISONING 8. DECISION TREE 9. TOOLS REFERENCE Tool Purpose h2csmuggler h2c upgrade smuggling (github.com/BishopFox/h2csmuggler) http2smugl H2 specific desync testing (github.com/neex/http2smugl) h2 (Python) HTTP/2 protocol lib for frame crafting (github.com/python hyper/h2) nghttp2 H2 client/server tools (nghttp2.org) Burp HTTP Request Smuggler Automated variant scanning curl http2 Quick H2 probing (built in) 10. QUICK REFERENCE

http2-specific-attacks