skills.rest
dreadnode
dreadnodeOFFICIAL
Explore all skills by this author →
Website𝕏@dreadnodeGitHub

h2c-websocket-smuggling

Bypass reverse proxy ACLs and WAF rules via H2C and WebSocket smuggling.

11|1|Updated May 4, 2026
Search Tags:#red teaming#web penetration testing#h2c smuggling#websocket smuggling#reverse proxy bypass#ACL bypass
One-click install
npx skills add https://github.com/dreadnode/capabilities --skill h2c-websocket-smuggling
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: h2c-websocket-smuggling
Source: https://github.com/dreadnode/capabilities/tree/main/capabilities/web-security/skills/h2c-websocket-smuggling
Command: npx skills add https://github.com/dreadnode/capabilities --skill h2c-websocket-smuggling

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill solves the problem of reverse proxies blocking access to internal backend paths and standard HTTP request smuggling techniques (CL.TE, TE.CL, TE.0) failing due to consistent body parsing between the proxy and backend server.

Core Features & Use Cases

  • H2C Smuggling: Exploit proxy forwarding of HTTP/2 cleartext (H2C) upgrade headers to establish a direct tunnel to the backend, bypassing path-based access control lists, WAF rules, and proxy-layer authentication checks.
  • WebSocket Smuggling: Leverage misconfigured WebSocket handshake validation (invalid version handling or SSRF-triggered health checks) to open persistent TCP tunnels to internal backend services.
  • Use Case: When testing a web application behind a reverse proxy that blocks access to internal admin endpoints, use this Skill to establish a direct connection to the backend server and access restricted resources that are not exposed via the proxy's configured paths.

Quick Start

Use the h2c-websocket-smuggling skill to test if the target reverse proxy forwards H2C upgrade headers and establish a tunnel to access blocked internal backend paths.

Frequently Asked Questions about h2c-websocket-smuggling

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I bypass reverse proxy ACLs to access blocked internal backend paths?▼

H2C smuggling exploits a reverse proxy that forwards HTTP/2 cleartext upgrade headers, allowing you to establish a direct tunnel to the backend server. This bypasses path-based access control lists, WAF rules, and proxy-layer authentication checks to reach restricted resources.

When should I use WebSocket smuggling instead of standard HTTP request smuggling?▼

Use WebSocket smuggling or H2C tunneling when standard HTTP request smuggling techniques like CL.TE, TE.CL, and TE.0 fail due to consistent body parsing between the proxy and backend server. This approach leverages misconfigured WebSocket handshake validation to open persistent TCP tunnels.

Can I bypass Web Application Firewall rules using h2csmuggler?▼

Yes, you can bypass Web Application Firewall rules using h2csmuggler by exploiting proxy forwarding of H2C upgrade headers. This establishes a direct connection to the backend server, accessing restricted resources not exposed via the proxy's configured paths.

How does WebSocket handshake validation enable TCP tunnel access to internal services?▼

WebSocket handshake validation enables TCP tunnel access when misconfigured to allow invalid version handling or SSRF-triggered health checks. This opens persistent TCP tunnels to internal backend services, bypassing the reverse proxy's path-based restrictions and WAF rules.

What are the limitations of H2C smuggling for web penetration testing?▼

H2C smuggling requires targets with reverse proxies that forward Upgrade headers or expose public WebSocket endpoints. It is ineffective if the proxy does not forward H2C upgrade headers or if WebSocket handshake validation is properly configured to reject invalid requests.

Related Skills

Explore More Software Engineering Skills→
DorianGalloDorianGallo
5

http2-specific-attacks

Identifies HTTP/2 attack paths exploiting framing, HPACK compression, multiplexing quirks, and downgrade flaws for authorized security testing.

Community
Advanced
wgpsecwgpsec
1.6k

cloud-metadata

Detect and exploit cloud instance metadata across AWS, Azure, GCP, Alibaba Cloud, and Tencent Cloud.

Official
Advanced
blacklanternsecurityblacklanternsecurity
253

request-smuggling

Detect and exploit HTTP request smuggling vulnerabilities using Burp Suite or smuggler.py.

Official
Advanced
YlikenYliken
5

request-smuggling

Detect and map HTTP request smuggling vulnerabilities across proxies and backends.

Community
Advanced