send_h2
Send HTTP/2 requests over TLS with ALPN for security testing. Enables raw frame mode and smuggling primitives.
Instructions
Send HTTP/2 request over TLS with ALPN negotiation. See rqwstr_docs(topic="http2") for raw-frame mode and smuggling primitives. Cookie handling matches send: an explicit Cookie in headers (or raw_headers) suppresses the per-hunt cookie jar, and a Cookie set in both sources is additive on the wire (both propagate, not deduped). raw_headers only reaches the wire on raw_mode or a pooled connection; on the standard HTTP/2 path raw_headers is not sent, so it neither suppresses the jar nor lands on the wire.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| sni | No | TLS SNI override. Decouples SNI from Host header. When set the TLS ServerName uses this value instead of the Host header. | |
| url | Yes | Target URL (must be HTTPS) | |
| body | No | Request body | |
| grep | No | Regex to filter response | |
| name | No | Save request with this name for quick lookup | |
| notes | No | Attach notes to request | |
| method | Yes | HTTP method (GET POST PUT DELETE etc) | |
| headers | No | Request headers | |
| raw_mode | No | Use raw H2 frame path. Bypasses Go HTTP/2 validation. Enables CRLF injection and Content-Length mismatch. | |
| body_file | No | Read request body from relative hunt artifact path; absolute paths require RQWSTR_ALLOW_ABSOLUTE_FILE_PATHS=1. Supports binary content and raw CRLF bytes. Takes precedence over body parameter. | |
| timeout_ms | No | Request timeout in ms (default 30000) | |
| raw_headers | No | Ordered header pairs [[name val]...] for raw_mode. Use instead of headers when order matters. | |
| connection_id | No | Reuse H2 connection by ID. Same connection_id = same TCP connection. For H2 smuggling self-verification (send smuggle + follow-up on same connection). Auto-closes after 60s idle. | |
| keep_alive_ms | No | Hold connection open after response for H2 smuggling. Sends PING keepalives. Milliseconds. raw_mode only. | |
| close_connection | No | Close a pooled connection by connection_id. Returns immediately without sending a request. | |
| grep_ignore_case | No | Case insensitive grep | |
| pause_after_headers_ms | No | Pause between HEADERS and DATA frames in milliseconds (raw_mode only). For pause-based desync attacks. | |
| content_length_override | No | Override Content-Length header value (raw_mode only). Set to a value different from body length for H2.CL smuggling. |