Lab: H2.CL request smuggling
Summary: PortSwigger's lab demonstrates H2.CL request smuggling, in which a front-end server downgrades HTTP/2 requests even when they carry an ambiguous length, letting a smuggled prefix redirect the next request on the connection to an arbitrary host. The exercise requires timing the poisoning of the connection immediately before the victim's browser imports a JavaScript resource, since the victim loads the home page every 10 seconds and the payload only executes if the timing is right.
What you should know: The attack succeeds because the front end and back end disagree on where a request ends, so a single crafted request can redirect another user's connection to an attacker-controlled host serving JavaScript that runs alert(document.cookie).
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026