Top 10 winner

h2c Smuggling: Request Smuggling Via HTTP/2 Cleartext (h2c)

Jake Miller and @theBumbleSec · labs.bishopfox.com

A proxy that forwards Upgrade and Connection headers lets a client negotiate HTTP/2 cleartext with the back end, after which the proxy stops inspecting traffic and becomes a blind TCP tunnel. Every multiplexed request sent through that tunnel evades the proxy's access controls and reaches restricted or internal endpoints.

Record

Researcher

Jake Miller and @theBumbleSec

Published by

labs.bishopfox.com

Topic

HTTP

In the archive

• Ranked #1 in the 2020 Top 10 Web Hacking Techniques

Related sources

• Research client

Tags

• request-smuggling
• http2
• smuggling
• auth-bypass
• reverse-proxy
• proxy
• load-balancer
• http
• tooling
• owasp-a01-2021

This page is the archive's own catalogue record. The research is the work of Jake Miller and @theBumbleSec, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 9 August 2026.