Lion Cipher Lab
HTTP/2 request smuggling — H2.CL, H2.TE, CRLF injection & h2c, then defend it
- AppSec / DevSecOps
- Advanced
- ~75 min
- Free · no account required
Why it matters
Everyone 'fixed' request smuggling by moving to HTTP/2 — and then quietly re-introduced it by downgrading HTTP/2 to HTTP/1.1 at the front-end. James Kettle's research showed this pattern is everywhere, affecting major sites and CDNs, because a downgrading front-end recreates the exact length ambiguity HTTP/2 was supposed to remove, and adds two failure modes HTTP/1 never had: header values that can smuggle newlines (CRLF injection) and cleartext-HTTP/2 (h2c) upgrades that tunnel straight past front-end security controls. The impact is the same brutal top-tier list — hijacking other users'…
What you'll learn
- why HTTP/2's built-in length was supposed to end smuggling — and why downgrading undoes it
- reading HTTP/2 requests: pseudo-headers (:method, :path, :scheme, :authority) vs regular headers
- H2.CL desync — smuggling a prefix by adding a Content-Length the downgrade trusts
- H2.TE desync — surviving the downgrade with an attacker-supplied Transfer-Encoding
- CRLF injection into an HTTP/2 header value to forge headers or split a request on downgrade
- h2c smuggling — upgrading to cleartext HTTP/2 to tunnel straight past the front-end
- driving Burp's HTTP/2 Inspector: setting the protocol and hand-editing pseudo-headers
- naming the failure modes so you can spot them in a real multi-tier architecture
- the durable fix: HTTP/2 end-to-end with no downgrade, and what to do if you must downgrade
- why 'just use HTTP/2 everywhere' beats every WAF rule
Steps in this lab
- Where Part 1 left off — and the plot twist
- What 'HTTP/2 downgrade' means, and why it re-opens the bug
- Read an HTTP/2 request: pseudo-headers vs regular headers
- Set up: PortSwigger account + Burp Community with HTTP/2 (and where Pro helps)
- Exploit #1 — H2.CL: smuggle a prefix the downgrade trusts
- Exploit #2 — H2.TE: the Transfer-Encoding survives the downgrade
- Exploit #3 — CRLF injection into an HTTP/2 header value
- The other door: h2c smuggling (upgrade to cleartext HTTP/2)
- The fix, part 1: real HTTP/2 end-to-end — no downgrade
- The fix, part 2 (opinion): why 'HTTP/2 everywhere' beats every WAF rule
- What you actually learned — and why it outlasts the trick