http2-specific-attacks

A web-security playbook focused on attack surface unique to HTTP/2, beyond the CL.TE/TE.CL fundamentals of HTTP/1.1 request smuggling. It surveys the protocol's distinctive features, binary framing, HPACK header compression, stream multiplexing, server push, and pseudo-headers (:method, :path, :authority, :scheme), and the attacks each enables. A central technique is h2c (cleartext HTTP/2) smuggling, where a reverse proxy blindly forwards an Upgrade: h2c request and becomes a transparent TCP tunnel, letting an attacker bypass proxy-enforced access controls, WAF rules, rate limiting, authentication, and IP restrictions by speaking HTTP/2 directly to the backend.

Pseudo-header manipulation is covered in depth: path discrepancies that let a request pass a proxy rule while the backend serves something else, duplicate :path injection exploiting differing first/last selection between proxy and backend, :authority-versus-Host disagreement, and :scheme manipulation to appear 'internal'. Other sections address HPACK compression attacks (CRIME/BREACH-style oracles and dynamic-table poisoning across pooled connections) and stream-multiplexing abuse, most notably the single-packet attack, which packs many requests into one TCP segment for tight race-condition timing (with an h2 library example), plus the RST_STREAM 'Rapid Reset' flood (CVE-2023-44487).

Use it when a target supports HTTP/2 and you want to exploit protocol-level behavior rather than reuse HTTP/1.1 smuggling assumptions, which the material warns are often conflated. It includes a detection recipe for h2c (sending an Upgrade request and checking for 101 Switching Protocols) and references the h2csmuggler tool. The routing section links to related skills for request smuggling fundamentals and H2.CL/H2.TE variants, race conditions that leverage the single-packet attack, and cache poisoning via smuggled responses. The content is presented for authorized security testing of HTTP/2-capable infrastructure.