h2-connect-internal-scan

What problem does it solve?

This Skill solves the challenge of enumerating internal services and open ports hidden behind HTTP/2-enabled reverse proxies or load balancers, where standard port scanning and SSRF techniques are blocked by perimeter firewall rules.

Core Features & Use Cases

• HTTP/2 Compatibility Verification: Confirms the target supports HTTP/2 ALPN negotiation to validate the attack vector is viable before proceeding.
• Multiplexed Internal Port Scanning: Uses concurrent HTTP/2 CONNECT requests to scan high-value internal ports (including databases, caches, and internal admin interfaces) without triggering standard firewall blocks.
• Use Case: For authorized red team engagements, use this Skill to map the internal attack surface of cloud-hosted applications that sit behind H2 proxies, identifying exposed sensitive services that are not reachable from the public internet.

Quick Start

Use the h2-connect-internal-scan skill to scan for open internal ports on the target web application that supports HTTP/2 and is fronted by a reverse proxy.