http2-specific-attacks
http2 specific attacks
What it does
- request-smuggling — CL.TE/TE.CL/TE.TE fundamentals and H2.CL/H2.TE variants
- request-smuggling/H2SMUGGLINGVARIANTS.md — byte-level H2.CL/H2.TE payloads, CL.0, client-side desync
- race-condition — single-packet attack leverages H2 multiplexing for race conditions
- web-cache-deception — cache poisoning via H2 smuggled responses
Requirements & configuration
- requires many requests on same connection. Harder than original CRIME.
- H2 requires lowercase. Sending Transfer-Encoding (uppercase) is invalid H2 but some proxies pass it → valid H1 header on backend.
- │ ├── Need race condition?
Configuration: POST
Derived from the skill's own SKILL.md documentation · extracted 2026-07-23
http2-specific-attacks FAQ
What does the http2-specific-attacks skill do?
>- HTTP/2 protocol-specific attack playbook. Use when the target supports HTTP/2 and you need to exploit binary framing, HPACK compression, h2c upgrade smuggling, pseudo-header injection, stream multiplexing abuse, or H2→H1 downgrade translation flaws. request-smuggling — CL.TE/TE.CL/TE.TE fundamentals and H2.CL/H2.TE variants request-smuggling/H2SMUGGLINGVARIANTS.md — byte-level H2.CL/H2.TE payloads, CL.0, client-side desync
What does http2-specific-attacks require?
requires many requests on same connection. Harder than original CRIME. H2 requires lowercase. Sending Transfer-Encoding (uppercase) is invalid H2 but some proxies pass it → valid H1 header on backend. │ ├── Need race condition? Configuration keys: POST.
How do I install http2-specific-attacks?
Run: npx -y skills add https://github.com/yaklang/hack-skills --skill http2-specific-attacks --agent claude-code — the source lives at github.com/yaklang/hack-skills.
Maintain http2-specific-attacks?
Let people know it's listed here — add the badge (live metrics, light/dark aware) or a plain link to your README or docs.
[http2-specific-attacks on getagentictools](https://getagentictools.com/skills/yaklang-hack-skills-http2-specific-attacks?ref=badge) npx agentictools info skills/yaklang-hack-skills-http2-specific-attacks The second line is the CLI lookup for this page — handy in READMEs and docs.
