Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

set headers for fuzzing request #5988

Open
wants to merge 1 commit into
base: dev
Choose a base branch
from
Open

set headers for fuzzing request #5988

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions pkg/protocols/http/request_fuzz.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,6 +62,7 @@ func (request *Request) executeFuzzingRule(input *contextargs.Context, previous
if err != nil {
return errors.Wrap(err, "fuzz: could not build request obtained from target file")
}
request.addHeadersToRequest(baseRequest)
input.MetaInput.Input = baseRequest.URL.String()
// execute with one value first to checks its applicability
err = request.executeAllFuzzingRules(input, previous, baseRequest, callback)
Expand Down Expand Up @@ -94,6 +95,7 @@ func (request *Request) executeFuzzingRule(input *contextargs.Context, previous
}
userAgent := useragent.PickRandom()
baseRequest.Header.Set("User-Agent", userAgent.Raw)
request.addHeadersToRequest(baseRequest)

// execute with one value first to checks its applicability
err = request.executeAllFuzzingRules(inputx, previous, baseRequest, callback)
Expand All @@ -112,6 +114,12 @@ func (request *Request) executeFuzzingRule(input *contextargs.Context, previous
return nil
}

func (request *Request) addHeadersToRequest(baseRequest *retryablehttp.Request) {
for k, v := range request.Headers {
baseRequest.Header.Set(k, v)
}
}
Comment on lines +117 to +121
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛠️ Refactor suggestion

Add header validation and security controls

The current implementation could benefit from additional security controls:

  1. Validate header names and values to prevent header injection
  2. Consider protecting security-critical headers (e.g., Authorization, Cookie)
  3. Add logging for security-sensitive header modifications

Here's a suggested implementation:

 func (request *Request) addHeadersToRequest(baseRequest *retryablehttp.Request) {
+    // List of headers that require special handling
+    sensitiveHeaders := map[string]bool{
+        "Authorization": true,
+        "Cookie":       true,
+        "Origin":       true,
+    }
+
     for k, v := range request.Headers {
+        // Basic validation
+        if k == "" || strings.Contains(k, "\n") || strings.Contains(v, "\n") {
+            continue
+        }
+
+        // Log modifications to sensitive headers
+        if sensitiveHeaders[k] {
+            gologger.Debug().Msgf("Modifying sensitive header: %s", k)
+        }
+
         baseRequest.Header.Set(k, v)
     }
 }
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
func (request *Request) addHeadersToRequest(baseRequest *retryablehttp.Request) {
for k, v := range request.Headers {
baseRequest.Header.Set(k, v)
}
}
func (request *Request) addHeadersToRequest(baseRequest *retryablehttp.Request) {
// List of headers that require special handling
sensitiveHeaders := map[string]bool{
"Authorization": true,
"Cookie": true,
"Origin": true,
}
for k, v := range request.Headers {
// Basic validation
if k == "" || strings.Contains(k, "\n") || strings.Contains(v, "\n") {
continue
}
// Log modifications to sensitive headers
if sensitiveHeaders[k] {
gologger.Debug().Msgf("Modifying sensitive header: %s", k)
}
baseRequest.Header.Set(k, v)
}
}


// executeAllFuzzingRules executes all fuzzing rules defined in template for a given base request
func (request *Request) executeAllFuzzingRules(input *contextargs.Context, values map[string]interface{}, baseRequest *retryablehttp.Request, callback protocols.OutputEventCallback) error {
applicable := false
Expand Down
Loading