Hackmanit / Web-Cache-Vulnerability-Scanner

Web Cache Vulnerability Scanner is a Go-based CLI tool for testing for web cache poisoning. It is developed by Hackmanit GmbH (http://hackmanit.de/).
Other
879 stars 129 forks source link

Cannot Specify "Host" Header while scanning #15

Closed chencohen3 closed 11 months ago

chencohen3 commented 1 year ago

Hello, I was trying to run a tests against my CDN. the caching is working in a way that it looks for the "Host" header that should be the origin of the files, for example to fetch the file a.js from the cache it'll ask for the Host Header with the origin name. so If I run the following : curl -H 'Host: origin-server.com' http://my-cache-cdn-url.com/a.js I'll get the content from the server. however if the same command is run without the Host Header, the cdn will respond with 404 not found. I've tried to run wvcs by running ./wcvs -url http://my-cache-cdn-url.com/a.js -sh "Host: origin-server.com", however it seems like wvcs is ignoring specifically the "host" header since I intercepted the traffic and saw that the header is not present on the request. also I was checking if I might be doing it wrong but once I changed "host" to "host1" it worked. image

m10x commented 1 year ago

Hello @chencohen3 , unfortunately this is a limitation of golang's http libraries. It is not possible to alter the Host (nor the Content-Length) header. We developed a workaround for this for another tool (which will be released in a few weeks). However, we don't have a schedule yet, if and when this will be transferred to wcvs. The following workaround may be applicable to you: