skills.rest
dreadnode
dreadnodeOFFICIAL
Explore all skills by this author →
Website𝕏@dreadnodeGitHub

h2-connect-internal-scan

Enumerate internal services via HTTP/2 CONNECT requests through reverse proxies.

11|1|Updated May 4, 2026
Search Tags:#ssrf#port-scanning#reverse-proxy#red-teaming#http2#internal-services#firewall-bypass
One-click install
npx skills add https://github.com/dreadnode/capabilities --skill h2-connect-internal-scan
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: h2-connect-internal-scan
Source: https://github.com/dreadnode/capabilities/tree/main/capabilities/web-security/skills/h2-connect-internal-scan
Command: npx skills add https://github.com/dreadnode/capabilities --skill h2-connect-internal-scan

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill solves the challenge of enumerating internal services and open ports hidden behind HTTP/2-enabled reverse proxies or load balancers, where standard port scanning and SSRF techniques are blocked by perimeter firewall rules.

Core Features & Use Cases

  • HTTP/2 Compatibility Verification: Confirms the target supports HTTP/2 ALPN negotiation to validate the attack vector is viable before proceeding.
  • Multiplexed Internal Port Scanning: Uses concurrent HTTP/2 CONNECT requests to scan high-value internal ports (including databases, caches, and internal admin interfaces) without triggering standard firewall blocks.
  • Use Case: For authorized red team engagements, use this Skill to map the internal attack surface of cloud-hosted applications that sit behind H2 proxies, identifying exposed sensitive services that are not reachable from the public internet.

Quick Start

Use the h2-connect-internal-scan skill to scan for open internal ports on the target web application that supports HTTP/2 and is fronted by a reverse proxy.

Frequently Asked Questions about h2-connect-internal-scan

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan internal ports when standard SSRF and port scanning are blocked by a firewall?▼

HTTP/2 CONNECT internal port scanning bypasses perimeter firewall rules by leveraging HTTP/2 stream multiplexing to send concurrent CONNECT requests to internal IP addresses, identifying reachable sensitive services hidden behind reverse proxies.

How does HTTP/2 CONNECT method bypass firewalls for internal service enumeration?▼

The HTTP/2 CONNECT method bypasses firewalls by using stream multiplexing to concurrently request internal hosts and ports through an HTTP/2-enabled reverse proxy, mapping internal services without triggering standard network firewall blocks.

Can I use HTTP/2 multiplexing to discover internal databases and admin interfaces?▼

Yes, you can discover internal databases, caches, and admin interfaces by sending concurrent HTTP/2 CONNECT requests through a fronting proxy, enumerating high-value internal services that are unreachable from the public internet.

Does HTTP/2 CONNECT internal port scanning work on any reverse proxy?▼

This technique only works on targets where the reverse proxy supports HTTP/2 ALPN negotiation and does not explicitly block HTTP/2 CONNECT method requests to internal hosts, making compatibility verification a necessary first step.

What is the best way to map the internal attack surface of cloud-hosted applications behind H2 proxies?▼

The best way to map the internal attack surface is using multiplexed HTTP/2 CONNECT requests during authorized red team engagements to identify exposed sensitive services behind H2-enabled reverse proxies.

Related Skills

Explore More Software Engineering Skills→
randrand
126

discover-protocols

Automate discovery of protocol skills for HTTP, TCP, UDP, and QUIC workflows.

Community
Basic
wgpsecwgpsec
1.6k

internal-recon

Map live hosts, open ports, services, and critical assets in internal networks using fscan.

Official
Intermediate
asdfgh1445asdfgh1445
735

Strix•SSRF 测试

Identify SSRF attack surfaces in web applications and cloud environments.

Community
Intermediate
AcczdyAcczdy
2

conducting-network-penetration-test

Automate authorized network penetration testing with Nmap NSE scripts and reporting.

Community
Advanced