0

Nowadays websites start migrating to HTTP/2, but Burpsuite hasn't fully support HTTP/2 yet. I know HTTPCanary is good and support multiple protocols like replaying HTTP2 and even TCP/UDP, but that only available in Android.

Are there any similar tools that provide the same functionality as Burpsuite that already supports HTTP/2?

maximillian1
  • 48
  • 4
  • Unfortunately, questions of the type "are there products/services that do X?" are off-topic has the lists could be endless and they don't tend to age well. – schroeder Sep 24 '20 at 08:58

1 Answers1

2

Information Security SE isn't really for product recommendations, but the subject is covered pretty well in Stuart Walker: Testing HTTP/2 only web services.

The reason why the tools haven't been developed into this direction is probably because debugging HTTP/2 itself hasn't been that common with such tools. When testing web application security, the target isn't the protocol used to transmit the content, but the application. Most servers do support fallback to HTTP/1.1, and you can always put a reverse proxy in front of those that don't.

Esa Jokinen
  • 16,100
  • 5
  • 50
  • 55