http2-attacks

To test for H2C smuggling, you need to identify cleartext upgrade weaknesses to reach internal endpoints. This methodology assesses HTTP/2 request smuggling by applying tools like h2c smuggler to detect misconfigurations affecting your web services.

HPACK header injection tests HTTP/2 header compression vulnerabilities that could bypass security defenses. This methodology evaluates these protocol-level flaws to identify misconfigurations within the HPACK compression mechanism affecting modern web applications.

Identifying H2.CL and H2.TE request smuggling involves finding HTTP/2 request smuggling vectors through complex header handling. This methodology detects these protocol-level vulnerabilities by analyzing how your service processes malformed requests.

Yes, this HTTP/2 testing methodology specifies requirements for using h2c smuggler, h2load, and nghttp2. These tools are necessary to properly assess connection coalescing, stream reset DoS scenarios, and protocol-level vulnerabilities.

The best way to assess connection coalescing risks is to evaluate cross-domain vulnerabilities via shared TLS connections. This methodology identifies these HTTP/2 attack vectors by testing how your web service handles shared connection routing.

Measuring resilience against HTTP/2 stream reset attacks requires testing rapid reset DoS scenarios on your web service. This methodology evaluates your service's stability and protocol-level defenses when subjected to malicious stream resets.