diff --git a/v2/go.mod b/v2/go.mod index c0d3aa392..534037e86 100644 --- a/v2/go.mod +++ b/v2/go.mod @@ -71,11 +71,13 @@ require ( github.com/asaskevich/govalidator v0.0.0-20210307081110-f21760c49a8d github.com/docker/go-units v0.4.0 github.com/h2non/filetype v1.1.3 + github.com/hashicorp/go-version v1.4.0 github.com/mholt/archiver v3.1.1+incompatible github.com/openrdap/rdap v0.9.1-0.20191017185644-af93e7ef17b7 github.com/projectdiscovery/iputil v0.0.0-20210804143329-3a30fcde43f3 github.com/projectdiscovery/nvd v1.0.9-0.20220314070650-d4a214c1f87d github.com/projectdiscovery/sliceutil v0.0.0-20220225084130-8392ac12fa6d + github.com/projectdiscovery/urlutil v0.0.0-20210525140139-b874f06ad921 github.com/projectdiscovery/wappalyzergo v0.0.35 github.com/stretchr/testify v1.7.1 github.com/zmap/zcrypto v0.0.0-20211005224000-2d0ffdec8a9b @@ -117,7 +119,6 @@ require ( github.com/gosuri/uiprogress v0.0.1 // indirect github.com/hashicorp/go-cleanhttp v0.5.1 // indirect github.com/hashicorp/go-retryablehttp v0.6.8 // indirect - github.com/hashicorp/go-version v1.4.0 // indirect github.com/iancoleman/orderedmap v0.0.0-20190318233801-ac98e3ecb4b0 // indirect github.com/itchyny/timefmt-go v0.1.3 // indirect github.com/jmespath/go-jmespath v0.4.0 // indirect diff --git a/v2/go.sum b/v2/go.sum index ec85e8eec..ed74e849a 100644 --- a/v2/go.sum +++ b/v2/go.sum @@ -485,12 +485,15 @@ github.com/projectdiscovery/retryablehttp-go v1.0.2 h1:LV1/KAQU+yeWhNVlvveaYFsjB github.com/projectdiscovery/retryablehttp-go v1.0.2/go.mod h1:dx//aY9V247qHdsRf0vdWHTBZuBQ2vm6Dq5dagxrDYI= github.com/projectdiscovery/sliceutil v0.0.0-20220225084130-8392ac12fa6d h1:wIQPYRZEwTeJuoZLv3NT9r+il2fAv1ObRzTdHkNgOxk= github.com/projectdiscovery/sliceutil v0.0.0-20220225084130-8392ac12fa6d/go.mod h1:QHXvznfPfA5f0AZUIBkbLapoUJJlsIDgUlkKva6dOr4= +github.com/projectdiscovery/stringsutil v0.0.0-20210524051937-51dabe3b72c0/go.mod h1:TVSdZC0rRQeMIbsNSiGPhbmhyRtxqqtAGA9JiiNp2r4= github.com/projectdiscovery/stringsutil v0.0.0-20210804142656-fd3c28dbaafe/go.mod h1:oTRc18WBv9t6BpaN9XBY+QmG28PUpsyDzRht56Qf49I= github.com/projectdiscovery/stringsutil v0.0.0-20210823090203-2f5f137e8e1d/go.mod h1:oTRc18WBv9t6BpaN9XBY+QmG28PUpsyDzRht56Qf49I= github.com/projectdiscovery/stringsutil v0.0.0-20210830151154-f567170afdd9/go.mod h1:oTRc18WBv9t6BpaN9XBY+QmG28PUpsyDzRht56Qf49I= github.com/projectdiscovery/stringsutil v0.0.0-20220208075244-7c05502ca8e9/go.mod h1:oTRc18WBv9t6BpaN9XBY+QmG28PUpsyDzRht56Qf49I= github.com/projectdiscovery/stringsutil v0.0.0-20220404001522-0d00e0703d0d h1:QYq+NO3fGJyQNvvuciJDUb5LvTZLjRPP5hl7yk/G96A= github.com/projectdiscovery/stringsutil v0.0.0-20220404001522-0d00e0703d0d/go.mod h1:oTRc18WBv9t6BpaN9XBY+QmG28PUpsyDzRht56Qf49I= +github.com/projectdiscovery/urlutil v0.0.0-20210525140139-b874f06ad921 h1:EgaxpJm7+lKppfAHkFHs+S+II0lodp4Gu3leZCCkWlc= +github.com/projectdiscovery/urlutil v0.0.0-20210525140139-b874f06ad921/go.mod h1:oXLErqOpqEAp/ueQlknysFxHO3CUNoSiDNnkiHG+Jpo= github.com/projectdiscovery/wappalyzergo v0.0.35 h1:UDjCmOygrY0Q25ZH4jz5pEw67wPxO6ilHYJQoxgdfu4= github.com/projectdiscovery/wappalyzergo v0.0.35/go.mod h1:vS+npIOANv7eKsEtODsyRQt2n1v8VofCwj2gjmq72EM= github.com/projectdiscovery/yamldoc-go v1.0.2/go.mod h1:7uSxfMXaBmzvw8m5EhOEjB6nhz0rK/H9sUjq1ciZu24= diff --git a/v2/pkg/protocols/http/request_annotations.go b/v2/pkg/protocols/http/request_annotations.go index 1ae9feac6..e763e3e42 100644 --- a/v2/pkg/protocols/http/request_annotations.go +++ b/v2/pkg/protocols/http/request_annotations.go @@ -1,19 +1,47 @@ package http import ( + "net" "net/http" "regexp" "strings" + + "github.com/projectdiscovery/iputil" + "github.com/projectdiscovery/stringsutil" + "github.com/projectdiscovery/urlutil" ) // @Host:target overrides the input target with the annotated one (similar to self-contained requests) -var reHostAnnotation = regexp.MustCompile(`(?m)^@Host:(.+)$`) +var reHostAnnotation = regexp.MustCompile(`(?m)^@Host:\s*(.+)\s*$`) // parseAnnotations and override requests settings func parseAnnotations(rawRequest string, request *http.Request) { // parse request for known ovverride annotations if hosts := reHostAnnotation.FindStringSubmatch(rawRequest); len(hosts) > 0 { - host := strings.TrimSpace(hosts[1]) - request.URL.Host = host + value := strings.TrimSpace(hosts[1]) + // handle scheme + switch { + case stringsutil.HasPrefixI(value, "http://"): + request.URL.Scheme = urlutil.HTTP + case stringsutil.HasPrefixI(value, "https://"): + request.URL.Scheme = urlutil.HTTPS + } + + value = stringsutil.TrimPrefixAny(value, "http://", "https://") + + if isHostPort(value) { + request.URL.Host = value + } } } + +func isHostPort(value string) bool { + _, port, err := net.SplitHostPort(value) + if err != nil { + return false + } + if !iputil.IsPort(port) { + return false + } + return true +}