Skip to content

Probe a host through a given ip from the input list #2667

Open

Description

@mazzz3r

Please describe your feature request:

An input line that gives the ip to probe a target through, like curl --resolve: the connection goes to the ip, and the hostname stays in the Host header and SNI. The JSON line nuclei would use for the same thing (https://github.com/orgs/projectdiscovery/discussions/7862) fits, so one list could feed both tools:

{"target": "https://app.example.com", "ip": "192.0.2.10"}
{"target": "https://app.example.com", "ip": "192.0.2.11"}

Describe the use case of this feature:

Probing a vhost on a given server, an origin behind a CDN, or one host on each of its servers. The vhost,ip input form builds the URL from the ip and sends the vhost only as the Host header, so there is no SNI, and url and host report the ip. -pa probes the ips DNS returns, not given ones, and the way it passes each ip doesn't reach them correctly. With app.test resolving to 127.0.0.1 and 127.0.0.2, a server on each whose title is its address, and redir.test redirecting to other.test, which resolves to 127.0.0.3 (dev at c9148f0):

$ echo http://app.test:18080 | httpx -pa -title -ip -silent
http://app.test:18080 [srv=127.0.0.2 host=app.test:18080] [127.0.0.1]
http://app.test:18080 [srv=127.0.0.2 host=app.test:18080] [127.0.0.2]

$ echo http://redir.test:18201 | httpx -pa -fr -title -ip -sc -silent
http://redir.test:18201 [302,200] [srv=127.0.0.1 host=other.test:18202] [127.0.0.1]

The implementation is in #2668. It is built on projectdiscovery/fastdialer#580 and stays a draft until a fastdialer release includes it.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type: EnhancementMost issues will probably ask for additions or changes.

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions