Agent skill · security · yaklang
http2-specific-attacks
HTTP/2 protocol-specific attack playbook. Use when the target supports HTTP/2 and you need to exploit binary framing, HPACK compression, h2c upgrade smuggling, pseudo-header injection, stream multiplexing abuse, or H2→H1 downgrade translation flaws.
Why this skill is useful
Includes detailed attack methodologies and executable scripts for exploiting HTTP/2 vulnerabilities that are not widely documented.
What it needs
Requires git, pip installed locally. About 6k tokens when loaded. Last updated 2026-06-16. 1,563 stars on the source repository.
What this skill does
SKILL: HTTP/2 Specific Attacks — Expert Attack Playbook AI LOAD INSTRUCTION: HTTP/2 protocol-level attack techniques beyond basic request smuggling. Covers h2c smuggling, pseudo-header manipulation, HPACK attacks, single-packet race conditions, and H2→H1 downgrade injection. Base models conflate HTTP/2 smuggling with HTTP/1.1 smuggling — this skill focuses on H2-unique attack surface. 0. RELATED ROUTING request-smuggling — CL.TE/TE.CL/TE.TE fundamentals and H2.CL/H2.TE variants request-smuggling/H2SMUGGLINGVARIANTS.md — byte-level H2.CL/H2.TE payloads, CL.0, client-side desync race-condition — single-packet attack leverages H2 multiplexing for race conditions web-cache-deception — cache poisoning via H2 smuggled responses --- 1. HTTP/2 ATTACK SURFACE OVERVIEW Feature Attack Surface --- --- Binary framing Frame-level manipulation, parser differentials HPACK compression Compression oracles (CRIME/BREACH), table poisoning Multiplexing Single-packet race conditions, RSTSTREAM flood Server push Cache poisoning via unsolicited push Pseudo-headers (:method/:path/:authority/:scheme) Injection, request splitting, path discrepancy --- 2. h2c (HTTP/2 CLEARTEXT) SMUGGLING 2.1 Concept h2c is HTTP/2 without TLS, negotiated via the HTTP/1.1 Upgrade mechanism. Many reverse proxies forward the Upgrade: h2c header without understanding it, allowing attackers to bypass proxy-level access controls. 2.2 Attack Flow 2.3 What You Can Bypass 2.4 Tool: h2csmuggler 2.5 Detection --- 3. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills yaklang/http2-specific-attacks