-
Notifications
You must be signed in to change notification settings - Fork 2
How to Send an HTTP Request Using HTTPClient
This is an example of how to write a module that uses the HttpClient mixin to send a basic HTTP request.
-
send_request_raw - You use this to send a raw HTTP request. Usually, you will want this method if you need something that violates the specification; in most other cases, you should prefer
send_request_cgi
. If you wish to learn about how this method works, look at the documentation forRex::Proto::Http::Client#request_raw
.
Here's a basic example of how to use send_request_raw
:
send_request_raw({'uri'=>'/index.php'})
-
send_request_cgi - You use this to send a higher-level HTTP request. For example, if your request contains a query string (or POST data), then you should use this. If you wish to learn about how this method works, check out
Rex::Proto::Http::Client#request_cgi
.
Both methods can automatically do the HTTP authentication if the user sets the "USERNAME" and "PASSWORD" advanced options.
Here's a very basic example for send_request_cgi
:
send_request_cgi({
'method' => 'GET',
'uri' => '/hello_world.php',
'vars_get' => {
'param_1' => 'abc',
'param_2' => '123'
}
})
Please note: send_request_raw
and send_request_cgi
will return a nil
if there's a timeout, so please make sure to account for that condition when you handle the return value.
Before you send a HTTP request, you will most likely have to do some URI parsing. This is a tricky task, because sometimes when you join paths, you may accidentally get double slashes, like this: "/test//index.php". Or for some reason you have a missing slash. These are really commonly made mistakes. So here's how you can handle it safely:
- Register your default URI datastore option as 'TARGETURI':
Example:
register_options(
[
OptString.new('TARGETURI', [true, 'The base path to XXX application', '/xxx_v1/'])
], self.class)
- Load your TARGETURI with
target_uri
, that way you get a realURI
object:
In this example, we'll just load the path:
uri = target_uri.path
- When you want to join another URI, always use
normalize_uri
:
Example:
# Returns: "/xxx_v1/admin/upload.php"
uri = normalize_uri(uri, 'admin', 'upload.php')
- When you're done normalizing the URI, you're ready to use
send_request_cgi
orsend_request_raw
Please note: The normalize_uri
method will always follow these rules:
- The URI should always begin with a slash.
- You will have to decide if you need the trailing slash or not.
- There should be no double slashes.
require 'msf/core'
class Metasploit3 < Msf::Auxiliary
include Msf::Exploit::Remote::HttpClient
def initialize(info = {})
super(update_info(info,
'Name' => 'HttpClient Example',
'Description' => %q{
Do a send_request_cgi()
},
'Author' => [ 'sinn3r' ],
'License' => MSF_LICENSE
))
register_options(
[
OptString.new('TARGETURI', [true, 'The base path', '/'])
], self.class)
end
def run
uri = target_uri.path
res = send_request_cgi({
'method' => 'GET',
'uri' => normalize_uri(uri, 'admin', 'index.phpp'),
'vars_get' => {
'p1' => "This is param 1",
'p2' => "This is param 2"
}
})
if res && res.code == 200
print_good("I got a 200, awesome")
else
print_error("No 200, feeling blue")
end
end
end
- Home Welcome to Metasploit!
- Using Metasploit A collection of useful links for penetration testers.
-
Setting Up a Metasploit Development Environment From
apt-get install
togit push
. - CONTIBUTING.md What should your contributions look like?
- Landing Pull Requests Working with other people's contributions.
- Using Git All about Git and GitHub.
- Contributing to Metasploit Be a part of our open source community.
- Meterpreter All about the Meterpreter payload.