h2csmuggler
Tests for HTTP/2 cleartext (h2c) smuggling to bypass reverse-proxy access controls and reach restricted internal endpoints.
Tags: h2c, smuggling, http2
- Category
- smuggling
- Maintenance signal
- maintained
Use this when: Smuggling. A protocol downgrade is a lead. Confirm it on a host you are allowed to test.
Install
git
git clone https://github.com/BishopFox/h2csmuggler && cd h2csmuggler/python && pip install -r requirements.txtCommand templates
Attempt h2c upgrade
python3 h2csmuggler.py -x {url} {target}