[go: up one dir, main page]
Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat(http): assign customHeaders to the map directly #5445

Merged
merged 1 commit into from
Jul 26, 2024
Merged

feat(http): assign customHeaders to the map directly #5445

merged 1 commit into from
Jul 26, 2024

Conversation

dwisiswant0
Copy link
Member

Proposed changes

Fix #5288.

[...] also add skip expr if header key is "Host".

Proof

As in the doc, "[...] To use non-canonical keys, assign to the map directly".

Template:

# headers-case-sensitive.yaml

id: test

info:
  name: test
  author: dwisiswant0
  severity: info
  description: test
  tags: test

http:
  - method: GET
    path:
      - "{{BaseURL}}/"
    headers:
      x-request-type: base
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}
        x-request-type: raw

Command

go run cmd/nuclei/main.go -H "foo: bar" -H "lOrem: iPsum" -t headers-case-sensitive.yaml -u https://scanme.sh -debug-req

Output

Before:

[INF] [test] Dumped HTTP request for https://scanme.sh/

GET / HTTP/1.1
Host: scanme.sh
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.1.2 Mobile/15E148 Safari/604.1
Connection: close
Accept: */*
Accept-Language: en
Foo: bar
Lorem: iPsum
x-request-type: base
Accept-Encoding: gzip

[INF] [test] Dumped HTTP request for https://scanme.sh

GET / HTTP/1.1
Host: scanme.sh
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.2.19
Connection: close
Foo: bar
Lorem: iPsum
x-request-type: raw
Accept-Encoding: gzip

[INF] No results found. Better luck next time!

After:

[INF] [test] Dumped HTTP request for https://scanme.sh/

GET / HTTP/1.1
Host: scanme.sh
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 14_3_1) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3.1 Safari/605.1.15
Connection: close
Accept: */*
Accept-Language: en
foo: bar
lOrem: iPsum
x-request-type: base
Accept-Encoding: gzip

[INF] [test] Dumped HTTP request for https://scanme.sh

GET / HTTP/1.1
Host: scanme.sh
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 11_5_1) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.1 Safari/605.1.15
Connection: close
foo: bar
lOrem: iPsum
x-request-type: raw
Accept-Encoding: gzip

[INF] No results found. Better luck next time!

Checklist

  • Pull request is created against the dev branch
  • All checks passed (lint, unit/integration/regression tests etc.) with my changes
  • I have added tests that prove my fix is effective or that my feature works
  • I have added necessary documentation (if appropriate)

@dwisiswant0
feat(http): assign customHeaders to the map directly
290637a 
also add skip expr if header key is "Host"

Signed-off-by: Dwi Siswanto <git@dw1.io>
@dwisiswant0
Copy link
Member Author

Anyone can answer https://github.com/projectdiscovery/nuclei/pull/5445/files#diff-74de151d167a5a2baddd58e1147646f15613a65f9e19645a8a54e8895a55f096R1086-R1087?

@ehsandeep ehsandeep requested a review from Mzack9999 July 26, 2024 08:14
tarunKoyalwar
tarunKoyalwar approved these changes Jul 26, 2024
View reviewed changes
Copy link
Member
@tarunKoyalwar tarunKoyalwar left a comment •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm!
@dwisiswant0 any specific reason we would want to convert them to lower case ?

if you meant converting kk during comparison ex:

if strings.ToLower(kk) == "Host"

we can do that as well as extra validation

@dwisiswant0
Copy link
Member Author

if you meant converting kk during comparison ex:

That's correct.

@dwisiswant0 dwisiswant0 merged commit 6d325a4 into projectdiscovery:dev Jul 26, 2024
12 checks passed
@dwisiswant0 dwisiswant0 deleted the dwisiswant0/feat/case-sensitive-header-key branch July 26, 2024 18:12
@BrewTestBot BrewTestBot mentioned this pull request Aug 16, 2024
Merged
@github-actions github-actions bot mentioned this pull request Sep 3, 2024
Closed
@blsaccess blsaccess mentioned this pull request Sep 3, 2024
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@Mzack9999 Mzack9999 Mzack9999 approved these changes

@tarunKoyalwar tarunKoyalwar tarunKoyalwar approved these changes

@ehsandeep ehsandeep Awaiting requested review from ehsandeep

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Nuclei transparently capitalizes and cannonicalizes headers
3 participants
@dwisiswant0 @Mzack9999 @tarunKoyalwar