> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/request-smuggling/queue-poisoning-with-h2-te.md).
# 使用 H2.TE 进行队列投毒
### 通过 H2.TE 请求走私进行响应队列投毒
* 利用请求走私漏洞对响应队列投毒。
* 利用这种投毒来访问 `/admin` 管理面板。
* 当管理员请求连接时，捕获该请求（以及其会话 cookie），然后删除 `carlos` 用户。
#### 技术背景
* 该应用接受请求 **HTTP/2** 前端。
* 前端 **降级** 将这些 HTTP/2 请求降级为 HTTP/1，即使长度存在歧义也是如此。
* 该攻击基于类型为 **H2.TE**:
* 发送一个同时包含以下内容的 HTTP/2 请求：
* 一个 `Transfer-Encoding: chunked` 页眉
* 一个 `Content-Length` 页眉
* 到后端的连接会 **每 10 个请求重置一次**:
* 如果连接“损坏”，只需发送几个正常请求即可恢复到干净连接。
* 在 HTTP/2 中，你不需要定义 `Content-Length` 通常，这使得同时存在的 `Transfer-Encoding` 和 `Content-Length` 变得模糊且可利用。
#### 攻击步骤
```http
POST / HTTP/2
Host: 0afc007a0423d9b980403f2c00dd00d7.web-security-academy.net
Transfer-Encoding: chunked
Content-Length: 120
0
GET / HTTP/1.1
Host: 0afc007a0423d9b980403f2c00dd00d7.web-security-academy.net
Content-Length: 12
testing=test
```
* HTTP/2 部分会被前端看到，前端会将其转换为供后端使用的 HTTP/1。
* 由于这种歧义 `H2.TE`，后端对请求结束位置的解析不同。
* 该 `GET / HTTP/1.1` 行以及其后内容被 **悄悄注入** 作为后端队列中下一请求的开头。
我们 **取回被投毒的管理员请求**，这使我们能够获得其 **会话 cookie**.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://hacking-notes.jord4n.pro/zh/web/request-smuggling/queue-poisoning-with-h2-te.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.