Repository navigation
Probe a host through a given ip from the input list #2667
Description
Please describe your feature request:
An input line that gives the ip to probe a target through, like curl --resolve: the connection goes to the ip, and the hostname stays in the Host header and SNI. The JSON line nuclei would use for the same thing (https://github.com/orgs/projectdiscovery/discussions/7862) fits, so one list could feed both tools:
{"target": "https://app.example.com", "ip": "192.0.2.10"}
{"target": "https://app.example.com", "ip": "192.0.2.11"}
Describe the use case of this feature:
Probing a vhost on a given server, an origin behind a CDN, or one host on each of its servers. The vhost,ip input form builds the URL from the ip and sends the vhost only as the Host header, so there is no SNI, and url and host report the ip. -pa probes the ips DNS returns, not given ones, and the way it passes each ip doesn't reach them correctly. With app.test resolving to 127.0.0.1 and 127.0.0.2, a server on each whose title is its address, and redir.test redirecting to other.test, which resolves to 127.0.0.3 (dev at c9148f0):
$ echo http://app.test:18080 | httpx -pa -title -ip -silent
http://app.test:18080 [srv=127.0.0.2 host=app.test:18080] [127.0.0.1]
http://app.test:18080 [srv=127.0.0.2 host=app.test:18080] [127.0.0.2]
$ echo http://redir.test:18201 | httpx -pa -fr -title -ip -sc -silent
http://redir.test:18201 [302,200] [srv=127.0.0.1 host=other.test:18202] [127.0.0.1]
-papasses each ip in thefastdialer.IPcontext value, and fastdialer serves the second ip from the dialer cached for the first one (Pinned dials reuse the dialer cached for the host:port, and cached dials send the wrong SNI fastdialer#579, PR fix: key the dial cache by the pinned ip, add WithResolveOverride fastdialer#580).- That value pins every dial made for the request, so a redirect to another host followed with
-frgoes to the probed ip. - IPv6 ips are passed in brackets, which fastdialer doesn't accept as an ip, so those probes fail with
no ips provided in dialWrap. - The favicon request and the ztls handshake are made with
context.Background(), so they drop the ip and reach the host through DNS, and-maxhrcounts errors per host:port, so errors on one ip skip the other ips of the host.
The implementation is in #2668. It is built on projectdiscovery/fastdialer#580 and stays a draft until a fastdialer release includes it.
Activity