search

PortSwigger / http-request-smuggler

https://portswigger.net/blog/http-desync-attacks
Other
952 stars 101 forks source link

Provide option to stop hostname resolution check #54

Open ahanel13 opened 1 year ago

ahanel13 commented 1 year ago

I'm running into an issue where the HTTP request smuggler extension will fail to run because it cannot resolve the hostname.

The host I'm testing can only be accessed through a proxy so I'm not 100% sure how the DNS resolves requests. Every request in the burp proxy history shows "unknown host", but everything works fine. I can usually bypass this issue resolution error with extensions like turbo intruder, but this one simply fails and quits.

Providing some options to stop this check would be great! Maybe I'm missing something in the settings as well, any help is appreciated!

albinowax commented 1 year ago

It doesn't do an explicit hostname check, it just uses the Burp API to send requests to the target. I'd suggest contacting PortSwigger support and seeing if they can help. Also, beware that request smuggling attacks don't typically play nicely with upstream HTTP proxies - you might end up exploiting the proxy itself