search

PortSwigger / http-request-smuggler

https://portswigger.net/blog/http-desync-attacks
Other
952 stars 101 forks source link

Attack menu doesn't show up for certain techniques #27

Closed plenumlab closed 4 years ago

plenumlab commented 4 years ago

For some attack techniques the menu Smuggle attack CL.TE or Smuggle attack TE.CL does not show up when i do right click . for instance i noticed that it's not working for this scenario: TrAnSfer-EnCOding: cHuNkeD I believe this is due to the check done in the class SuggestAttack.java on line 28

if (headers.contains("chunked") || headers.contains("Transfer-Encoding")) { ... }

So for any test that doesn't contain atleast one of those words the attack menu won't show up. Maybe add lower case before the check

albinowax commented 4 years ago

Good spot, it'll be fixed in the next release