How to create a URL request using vegeta library that includes %20 and single quotes

[ipochi]

Question

When i use vegeta cli echo "GET http://localhost:8082/endpoint/Moe%20'%20or%20'1'='1" | vegeta attack -rate=1 -duration=10s | vegeta report

It works fine.

However when I do the same using the library

        target := vegeta.Target{
            Method: http.MethodGet,
            URL:    "http://localhost:8082/endpoint/Moe%20'%20or%20'1'='1",
        }

i get a 400 bad request.

My use case is that I am using the vegeta library to exercise the application to get some benchmarks related to sql injection and I cannot use the vegeta cli , I need to use the library.

@tsenart If you could let me know where i am doing wrong , that would be great

[tsenart]

You need to parse the URL first with https://golang.org/pkg/net/url/#ParseRequestURI and then get it as string and put in the Target URL field.

[impochi]

@tsenart did that

u,err := url.ParseRequestURI("http://localhost:8082/endpoint/Moe%20'%20or%20'1'='1")
urlstr := u.String()
.
.
target.URL = urlstr

I still got the same result 400 bad request.

I am also generating a targets file in the code. manually created txt file and generated from above are exactly the same

yet i can do cat targets.txt | vegeta attack but not from the library

[tsenart]

Not sure what's going on. This is the code that parses the targets: https://github.com/tsenart/vegeta/blob/master/lib/targets.go#L291

[tsenart]

Maybe try to run https://github.com/tsenart/vegeta/tree/master/internal/cmd/echosrv to see what URLs end up being requested from the server in both instances. Look for differences.

[impochi]

@tsenart forgot to update.

The issue was with play framework , hosts enabled filter. I was running the whole setup in docker-compose and the service-name:port was not getting hit due to hte above configuration setting.

Once i did that , it worked.