http2-specific-attacks

Identifying HTTP/2 vulnerabilities requires analyzing binary framing, HPACK compression, stream multiplexing, server push, and pseudo-headers. This Skill guides security audits through attack techniques like h2c smuggling, pseudo-header injection, and multiplexing race conditions to expose protocol-level security weaknesses.

h2c smuggling is an HTTP/2 attack technique that exploits protocol upgrades to bypass frontend security controls. This Skill outlines detailed attack flows for h2c smuggling alongside other methods like pseudo-header injection and HPACK attacks, extending beyond basic request smuggling.

Yes, you can test HPACK compression attacks and multiplexing race conditions using this Skill. It provides an in-depth analysis and exploitation steps for these specific HTTP/2 features, detailing how stream multiplexing and header compression can be manipulated during penetration testing.

Yes, understanding HTTP/2 binary framing and protocol mechanics is required. This Skill is tailored for security audits and penetration testing, assuming the user already possesses foundational knowledge of HTTP/2 features and various attack techniques before executing the provided exploit flows.

HTTP/2 protocol-specific attack techniques are limited to vulnerabilities within binary framing, HPACK compression, multiplexing, server push, and pseudo-headers. They require precise protocol conditions to succeed and may not apply to targets utilizing hardened HTTP/2 implementations or distinct protocol versions.