skills.rest
ok-helloworld
ok-helloworldCOMMUNITY
Explore all skills by this author →
GitHub

http2-specific-attacks

Identify and test HTTP/2-specific request-smuggling and desynchronization vulnerabilities.

241|28|Updated May 20, 2026
Search Tags:#multiplexing#http2#h2c#hpack#pseudo-headers#request desync#downgrade smuggling
One-click install
npx skills add https://github.com/ok-helloworld/vibe-pentest --skill http2-specific-attacks-ok-helloworld
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: http2-specific-attacks
Source: https://github.com/ok-helloworld/vibe-pentest/tree/main/references/pentest_skills/http2-specific-attacks
Command: npx skills add https://github.com/ok-helloworld/vibe-pentest --skill http2-specific-attacks-ok-helloworld

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

HTTP/2-specific request/response desynchronization and framing weaknesses are often missed by generic HTTP request-smuggling guidance, causing you to test with the wrong assumptions and miss real vulnerabilities.

Core Features & Use Cases

  • h2c Upgrade Smuggling Guidance: Bypass HTTP/2-unsupported proxy enforcement by using the HTTP/1.1 Upgrade mechanism to reach a backend that speaks HTTP/2.
  • Pseudo-Header Manipulation & Routing Confusion: Identify access-control and vhost routing discrepancies caused by :path, :authority, and :scheme handling differences across proxy vs backend.
  • HPACK & Multiplexing Attack Patterns: Use HTTP/2 compression-context and multiplexing behaviors to explore oracle-style leakage, race conditions, and resource exhaustion paths.
  • H2→H1 Downgrade Flaw Checks: Look for header injection and smuggling-like effects that appear only when intermediaries translate HTTP/2 into HTTP/1.1.

Quick Start

Ask an authorized testing agent to apply the HTTP/2 decision tree to your target, first verifying HTTP/2 and any h2c upgrade behavior, then attempting pseudo-header discrepancies, downgrade-related header injection, and multiplexing-focused race/DoS probes while recording reproducible evidence and safe stop conditions.

Frequently Asked Questions about http2-specific-attacks

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test pseudo-header manipulation for routing confusion in HTTP/2?▼

Pseudo-header manipulation targets :path, :authority, and :scheme to cause access-control and vhost routing discrepancies. Different parsing logic between the proxy and backend allows attackers to route requests to restricted endpoints.

Can HTTP/2 multiplexing and HPACK compression cause race conditions or data leakage?▼

Detect H2→H1 downgrade flaws by translating HTTP/2 requests to HTTP/1.1 through intermediaries and observing header injection or smuggling-like effects. This occurs when translation logic mishandles framing, creating desync opportunities not present in native HTTP/2.

How do I detect H2 to H1 downgrade header injection vulnerabilities?▼

Detect H2→H1 downgrade flaws by translating HTTP/2 requests to HTTP/1.1 through intermediaries and observing header injection or smuggling-like effects. This occurs when translation logic mishandles framing, creating desync opportunities not present in native HTTP/2.

What is h2c upgrade smuggling and how does it bypass proxy enforcement?▼

h2c upgrade smuggling uses the HTTP/1.1 Upgrade mechanism to reach an HTTP/2-speaking backend, bypassing front-end proxies that do not support HTTP/2. This creates differential parsing opportunities where proxies and backends interpret traffic differently.

How do I detect H2 to H1 downgrade header injection vulnerabilities?▼

Detect H2→H1 downgrade flaws by translating HTTP/2 requests to HTTP/1.1 through intermediaries and observing header injection or smuggling-like effects. This occurs when translation logic mishandles framing, creating desync opportunities not present in native HTTP/2.

Related Skills

Explore More Software Engineering Skills→
DorianGalloDorianGallo
5

http2-specific-attacks

Identifies HTTP/2 attack paths exploiting framing, HPACK compression, multiplexing quirks, and downgrade flaws for authorized security testing.

Community
Advanced
xjtu-wangxjtu-wang
4

competition-request-normalization-smuggling

Trace parser drift and request-smuggling indicators across proxy-to-backend boundaries.

Community
Advanced
blacklanternsecurityblacklanternsecurity
253

request-smuggling

Detect and exploit HTTP request smuggling vulnerabilities using Burp Suite or smuggler.py.

Official
Advanced
lNwNllNwNl
2

http2-specific-attacks

Identify HTTP/2 attack vectors exploiting binary framing, HPACK, multiplexing, and downgrade flaws.

Community
Advanced