skills.rest
DorianGallo
DorianGalloCOMMUNITY
Explore all skills by this author →
GitHub

http2-specific-attacks

Identifies HTTP/2 attack paths exploiting framing, HPACK compression, multiplexing quirks, and downgrade flaws for authorized security testing.

5|2|Updated May 16, 2026
Search Tags:#multiplexing#downgrade#http2#h2c#smuggling#hpack#pseudo-headers
One-click install
npx skills add https://github.com/DorianGallo/hack-skills-local --skill http2-specific-attacks-doriangallo
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: http2-specific-attacks
Source: https://github.com/DorianGallo/hack-skills-local/tree/main/skills/http2-specific-attacks
Command: npx skills add https://github.com/DorianGallo/hack-skills-local --skill http2-specific-attacks-doriangallo

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

HTTP/2 protocol differences often break generic smuggling and desync guidance, so teams need a focused playbook for HTTP/2-specific attack paths like h2c upgrades, HPACK issues, and H2-to-H1 downgrade artifacts.

Core Features & Use Cases

  • h2c Upgrade Smuggling: Identify and abuse HTTP/2 clearttext upgrade flows to bypass proxy visibility and routing controls.
  • Pseudo-Header Manipulation: Test discrepancies in :path, :authority, and :scheme parsing between proxy and backend to reach unexpected resources.
  • HPACK and Multiplexing Abuse: Evaluate HPACK compression/table risks plus HTTP/2 multiplexing behaviors for race and resource-impact techniques.

Quick Start

Ask for a step-by-step HTTP/2 assessment plan that targets h2c upgrade behavior, pseudo-header routing inconsistencies, and HPACK/multiplexing risks for a specific domain and proxy setup.

Frequently Asked Questions about http2-specific-attacks

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test h2c upgrade smuggling against a reverse proxy?▼

To test h2c upgrade smuggling, you identify and abuse HTTP/2 cleartext upgrade flows to bypass proxy visibility and routing controls. This Skill operationalizes those attack paths by probing protocol negotiation and binary-frame semantics in authorized testing environments.

What is HTTP/2 pseudo-header manipulation and how does it reach unexpected backend resources?▼

HTTP/2 pseudo-header manipulation tests discrepancies in :path, :authority, and :scheme parsing between a proxy and backend. By exploiting these routing inconsistencies, you can reach unexpected resources that backend servers expose during H2-to-H1 downgrade translation.

How do I assess HPACK compression and multiplexing risks in HTTP/2?▼

You assess HPACK compression and multiplexing risks by evaluating HTTP/2 multiplexing behaviors for race conditions and resource-impact techniques. This involves analyzing HPACK table state and compression quirks to identify variant reasoning for smuggling and cache or push behavior.

Can I use generic HTTP smuggling techniques for HTTP/2 specific downgrade flaws?▼

Generic HTTP smuggling techniques often fail against HTTP/2 due to protocol differences. You need a focused playbook that targets H2-to-H1 downgrade translation artifacts, binary-frame semantics, and protocol negotiation scenarios like h2c upgrade to successfully identify attack paths.

What is the best way to start an HTTP/2 attack assessment for a specific domain?▼

The best way to start an HTTP/2 attack assessment is to request a step-by-step plan targeting h2c upgrade behavior, pseudo-header routing inconsistencies, and HPACK or multiplexing risks tailored to your specific domain and proxy setup.

Related Skills

Explore More Education & Research Skills→
dreadnodedreadnode
11

h2-connect-internal-scan

Enumerate internal services via HTTP/2 CONNECT requests through reverse proxies.

Official
Intermediate
zebbernzebbern
4.5k

IDOR Vulnerability Testing

Identify and exploit IDOR vulnerabilities in web applications.

Community
Advanced
ok-helloworldok-helloworld
241

http2-specific-attacks

Identify and test HTTP/2-specific request-smuggling and desynchronization vulnerabilities.

Community
Advanced
lNwNllNwNl
2

http2-specific-attacks

Identify HTTP/2 attack vectors exploiting binary framing, HPACK, multiplexing, and downgrade flaws.

Community
Advanced