nmap / nmap

Nmap - the Network Mapper. Github mirror of official SVN repository.
https://svn.nmap.org/
Other
9.94k stars 2.37k forks source link

Ncat handles manual HTTP requests badly #2430

Closed q2dg closed 2 years ago

q2dg commented 2 years ago

Describe the bug It seems something is sent wrongly when doing manual HTTP requests by ncat

To Reproduce Compare what happens when doing a simple REST request to some randomly tried server by curl and what happens when I've tried to mimic the same request using ncat (yes, it's ncat though I use nc command).

With curl:

Captura de pantalla de 2022-01-22 23-12-51

With ncat:

Captura de pantalla de 2022-01-22 23-14-16

Expected behavior I expect the same response using curl and using ncat (even I've used the same headers!)

Version info (please complete the following information):

p-l- commented 2 years ago

That's not a bug in Ncat. The problem is that Curl (as any HTTP client) uses CRLF ("\r\n") as end of line sequence, while ncat reads, from your input, a simple LF ("\n"). Ncat has an option to use CRLF instead of LF: -C:

$ ncat www.boredapi.com 80
GET /api/activity HTTP/1.1
Host: www.boredapi.com
User-Agent: curl/7.79.1
Accept: */*

HTTP/1.1 505 HTTP Version Not Supported
Connection: close
Server: Cowboy
Date: Sat, 22 Jan 2022 23:07:21 GMT
Content-Length: 0
$ ncat -C www.boredapi.com 80
GET /api/activity HTTP/1.1
Host: www.boredapi.com
User-Agent: curl/7.79.1
Accept: */*

HTTP/1.1 200 OK
Server: Cowboy
Connection: keep-alive
X-Powered-By: Express
Access-Control-Allow-Origin: *
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept
Content-Type: application/json; charset=utf-8
Content-Length: 141
Etag: W/"8d-kCHcv1nAi41TxLMowrAUkBepcxc"
Date: Sat, 22 Jan 2022 23:07:30 GMT
Via: 1.1 vegur

{"activity":"Play a game of tennis with a friend","type":"social","participants":2,"price":0.1,"link":"","key":"1093640","accessibility":0.4}

You can also use something like echo -en "GET / HTTP/1.0\r\n\r\n | ncat [...].

q2dg commented 2 years ago

Ooh, you're right!! It's this!! Sorry for having disturbing you with this so elemental question. At least, I hope this issue could be useful as a reference for anyone in the future with the same doubts than me. Thanks, thanks a lot!!!