HTTP/2 Request Smuggling

Walkthrough summary

HTTP/2 Request Smuggling TryHackMe walkthrough with 7 answered prompts and lab methodology notes.

Sample prompts covered

• Which version of the HTTP protocol uses \r\n to separate headers in a request?
  Open the walkthrough page to inspect the full answer and command flow.
• Which version of the HTTP protocol uses a binary format and clearly defines boundaries for elements in requests/responses?
  Open the walkthrough page to inspect the full answer and command flow.
• Repeat the request shown in the practical example against the app and wait for a user to fall for our trap. What is the username of the victim user who liked our post?
  Open the walkthrough page to inspect the full answer and command flow.
• What's the value of the leaked internal header?
  Open the walkthrough page to inspect the full answer and command flow.
• What is the value of the flag in /admin?
  Open the walkthrough page to inspect the full answer and command flow.