http2-specific-attackslisted

# SKILL: HTTP/2 Specific Attacks — Expert Attack Playbook > **AI LOAD INSTRUCTION**: HTTP/2 protocol-level attack techniques beyond basic request smuggling. Covers h2c smuggling, pseudo-header manipulation, HPACK attacks, single-packet race conditions, and H2→H1 downgrade injection. Base models conflate HTTP/2 smuggling with HTTP/1.1 smuggling — this skill focuses on H2-unique attack surface. ## 0. RELATED ROUTING - [request-smuggling](../request-smuggling/SKILL.md) — CL.TE/TE.CL/TE.TE fundamentals and H2.CL/H2.TE variants - [request-smuggling/H2_SMUGGLING_VARIANTS.md](../request-smuggling/H2_SMUGGLING_VARIANTS.md) — byte-level H2.CL/H2.TE payloads, CL.0, client-side desync - [race-condition](../race-condition/SKILL.md) — single-packet attack leverages H2 multiplexing for race conditions - [web-cache-deception](../web-cache-deception/SKILL.md) — cache poisoning via H2 smuggled responses --- ## 1. HTTP/2 ATTACK SURFACE OVERVIEW | Feature | Attack Surface | |---|---| | Binary framing | Frame-level manipulation, parser differentials | | HPACK compression | Compression oracles (CRIME/BREACH), table poisoning | | Multiplexing | Single-packet race conditions, RST_STREAM flood | | Server push | Cache poisoning via unsolicited push | | Pseudo-headers (`:method`/`:path`/`:authority`/`:scheme`) | Injection, request splitting, path discrepancy | --- ## 2. h2c (HTTP/2 CLEARTEXT) SMUGGLING ### 2.1 Concept h2c is HTTP/2 without TLS, negotiated via the HTTP/1.1 `Upgrade` mechanism