AI-Powered Application Penetration Testing—Scale Security Without Compromise Learn More

bishopfox-logo-grey
Get Started

Offensive Tools

h2c Smuggler: Smuggles HTTP traffic past insecure edge-server proxy_pass configurations

h2c Smuggler upgrades HTTP/1.1 connections to lesser-known HTTP/2 over cleartext (h2c) connections and can allow a bypass of reverse proxy access controls, and lead to long-lived, unrestricted HTTP traffic directly to back-end servers.


Get on GitHub

About h2c Smuggler

Features Overview

  • Works on some cleartext channels, and as long as the proxy does not support h2c upgrades and simply forwards the client’s h2c upgrade request to the back end, this attack will likely succeed on non-encrypted channels as well.
  • Can send as many requests as you like via HTTP/2 multiplexing
  • Enables a wide variety of attacks, including: forging internal headers, accessing restricted administrative endpoints, and sometimes Host header SSRF allowing further movement through the network.
  • Maintains a "defense in depth" strategy
  • Works in the event of multiple layers of proxies
  • Makes a strong candidate for low-latency intra-network (i.e., microservice) communication
  • Avoids the management and performance overhead of TLS
  • Tested on newly discovered attack techniques against customers of Bishop Fox's Continuous Attack Surface Testing (CAST)
Bishop Fox Labs Security Researcher Jake Miller

Lead Researcher

Jake Miller

Jake Miller (OSCE, OSCP) is a Bishop Fox alumnus and former lead researcher. While at Bishop Fox, Jake was responsible for overseeing firm-wide research initiatives. He also produced award-winning research in addition to several popular hacking tools like RMIScout and GitGot.

Twitter: @theBumbleSec

GitHub: the-bumble

See More from Jake

h2c Smuggling Research

Related Resources

HTTP request smuggling example
Technical Research

Sep 08, 2020

h2c Smuggling: Request Smuggling Via HTTP/2 Cleartext (h2c)

By Jake Miller