Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

"Allow HTTP/2 ALPN override" Feature

Emmany | Last updated: Mar 03, 2022 08:45PM UTC

I'm currently trying to solve labs under http request smuggling. There are four labs in that section that requires one to enable the "Allow HTTP/2 ALPN override" feature which is only available in Burp Suite Professional / Community 2021.9.1 My question is, why is that feature only available in that burp version? Why isn't it found generally in every other version? Why is it specifically that version?

Ben, PortSwigger Agent | Last updated: Mar 04, 2022 12:52PM UTC

Hi Emmany, The release 2021.9.1 was the first stable release to include the ability to manually test hidden HTTP/2 attack surfaces - this is carried out by being able to override ALPN via the "Allow HTTP/2 ALPN override" menu option. Releases prior to 2021.9.1 do not have this functionality (because, as noted above, this was new functionality added to Burp in this particular version) but every subsequent release after 2021.9.1 will have this functionality included within it.

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.