http-connection-contamination

What problem does it solve?

This skill solves the problem of inaccessible sensitive cross-subdomain resources in multi-subdomain web applications that share IP addresses and wildcard TLS certificates, where reverse proxies using first-request connection routing can be exploited to misroute requests to unintended backends.

Core Features & Use Cases

• Vulnerability Probing: Step-by-step checks to confirm if connection coalescing conditions (shared IP, wildcard certificate, first-request routing proxy) are present on the target.
• Attack Reproduction: Clear instructions and code snippets to reproduce the connection contamination attack to misroute requests to sensitive subdomains.
• Impact Analysis: Pre-defined impact scenarios for common infrastructure setups (WordPress + admin panels, API + frontend, multi-tenant portals, CDN + origin) to understand potential risk.
• Detection Checklist: An actionable checklist to confirm the vulnerability is exploitable on the target.
• Use Case: Red teamers can use this skill to quickly identify and exploit connection contamination flaws to access sensitive admin panels, API endpoints, or cross-tenant data without requiring man-in-the-middle positioning.

Quick Start

Use the http-connection-contamination skill to test a target's multi-subdomain infrastructure for HTTP/2 connection coalescing misrouting vulnerabilities and exploit them to access sensitive cross-subdomain resources.