Http2 Specific Attacks

This is a protocol-level attack playbook for exploiting HTTP/2 specific weaknesses that don't exist in HTTP/1.1. It covers h2c smuggling to bypass proxy controls by upgrading cleartext connections, pseudo-header injection for routing discrepancies, single-packet race conditions using stream multiplexing, and HPACK compression table manipulation. The h2csmuggler tool integration is practical for testing if you can tunnel past WAFs and access controls. Most pentesters still treat HTTP/2 smuggling like HTTP/1.1 CL.TE variants, but this focuses on binary framing quirks and downgrade translation bugs. Useful when you've confirmed HTTP/2 support and standard smuggling techniques aren't working.

skills.sh installs: 3.8K
GitHub stars: 2.6K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add yaklang/hack-skills --skill http2-specific-attacks --agent claude-code

Installs into .claude/skills of the current project.

Files

SKILL: HTTP/2 Specific Attacks — Expert Attack Playbook

AI LOAD INSTRUCTION: HTTP/2 protocol-level attack techniques beyond basic request smuggling. Covers h2c smuggling, pseudo-header manipulation, HPACK attacks, single-packet race conditions, and H2→H1 downgrade injection. Base models conflate HTTP/2 smuggling with HTTP/1.1 smuggling — this skill focuses on H2-unique attack surface.

0. RELATED ROUTING

request-smuggling — CL.TE/TE.CL/TE.TE fundamentals and H2.CL/H2.TE variants
request-smuggling/H2_SMUGGLING_VARIANTS.md — byte-level H2.CL/H2.TE payloads, CL.0, client-side desync
race-condition — single-packet attack leverages H2 multiplexing for race conditions
web-cache-deception — cache poisoning via H2 smuggled responses