PortSwigger / http-request-smuggler

https://portswigger.net/blog/http-desync-attacks
Other
952 stars 101 forks source link

Not detecting H2.CL #48

Open intrd opened 2 years ago

intrd commented 2 years ago

Hey guys, I used the req. smuggler probes to solve all the new labs, including the tunnel probes it was very helpful, but looks like its not working w/ HTTP/2 CL.

So I ended up solving the CL lab as TE as well, it confused me. Also noticed that almost of them has multiple solutions (CL and TE). I will not detail here because it will give spoiler to some ppl.

This is not a problem for this case, because its solvable as TE, but apparently it is really not detecting H2.CL in any way.

..btw, thank you for this amazing extension.

albinowax commented 2 years ago

Thanks for the heads up about the multiple solutions, we'll definitely make sure that doesn't happen in any H/2 related exam questions :)

Yeah I had some code to detect H2.CL but it caused too many false positives, and as H2.CL is really rare I left it out. We've included a lab on that primarily because it's good from a learning perspective. I'll leave this ticket open in case a good detection method turns up.