Objective: Check if a server supports SPDY and/or HTTP/2 protocols.
SPDY is a web protocol developed by Google for transporting web content. HTTP/2 is based on SPDY and was developed by the Hypertext Transfer Protocol working group of IETF. The primary goal of both these protocols is to reduce web page load time by prioritizing and multiplexing the transfer of web page sub-resources so that only one connection per client is required.
SPDY only works over TLS. HTTP/2 can work on either HTTP or TLS but current browsers only support HTTP/2 over TLS.
There are two ways that I know of to check if a web server has support for either SPDY and/or HTTP/2 protocols. One is by using openssl and the other is by using nmap. The basic idea is to add the next protocol negotiation extension in the client hello packet and parse the returned server hello’s NPN extension data.
With openssl, we need to use s_client. To check if the site www.google.com supports SPDY and/or HTTP/2, we can use the following syntax. 443 is the default port number for HTTPS/TLS.
|
1 2 |
$ openssl s_client -connect www.google.com:443 -nextprotoneg '' 2>&1 | grep -i ^protocol Protocols advertised by server: h2, spdy/3.1, http/1.1 |
The output gives the list of supported protocols for www.google.com. We can see that it supports 3 protocols – HTTP/2 (h2), SPDY (spdy/3.1) and HTTP/1.1 (http/1.1).
To scan using nmap, we need to use the tls-nextprotoneg script. Run nmap using the following syntax to get the supported protocol list.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 |
$ nmap -p 443 --script=tls-nextprotoneg www.google.com Starting Nmap 6.49BETA4 ( https://nmap.org ) at 2015-12-26 15:31 SGT Nmap scan report for www.google.com (101.100.190.215) Host is up (0.0026s latency). PORT STATE SERVICE 443/tcp open https | tls-nextprotoneg: | h2 | spdy/3.1 |_ http/1.1 Nmap done: 1 IP address (1 host up) scanned in 7.81 seconds |
As you can see, nmap is giving us the same result. The supported protocols are HTTP/2 (h2), SPDY (spdy/3.1) and HTTP/1.1 (http/1.1).
Mohamed Ibrahim
ibrahim = { interested_in(unix, linux, android, open_source, reverse_engineering); coding(c, shell, php, python, java, javascript, nodejs, react); plays_on(xbox, ps4); linux_desktop_user(true); }
