Documentation
¶
Overview ¶
Package requestscheme settles the scheme of a raw HTTP request whose request line does not carry one ("a mis-schemed target is loud").
A raw request line is origin-form, so httpmsg.ParseRawRequest infers a scheme: absolute-form request line, then a well-known Host port (80/443), then a same-origin Origin/Referer, then the https default. That default sent every request for a plain-http service on a non-standard port (a dev server on :3000, an API on :8080) over TLS, where it failed, and the run reported success with no findings.
Settle asks the network when nothing in the request decides: a TCP connect plus, on an explicit non-standard port, a TLS handshake (portsweep.ResolveScheme, the rules the host sweep uses for schemeless targets). It is the one implementation `vigolium scan-request` and POST /api/scan-request share; each caller decides what to tell its operator from the returned Result. ParseRawRequest itself is unchanged: it is shared with ingest and Burp import, where no probe is acceptable.
Index ¶
Constants ¶
const ( SourceExplicit = "explicit" // a target URL override, absolute-form request line, curl URL SourcePort = "port" // Host :80 / :443 SourceOrigin = "origin" // same-origin Origin header SourceReferer = "referer" // same-origin Referer header SourceProbe = "probe" // a connect / TLS handshake answered SourceDefault = "default" // nothing settled it; https assumed )
scheme_source values: what decided the scheme of a scanned request. They are reported on the scan-url / scan-request result and the REST response.
Variables ¶
This section is empty.
Functions ¶
func HostPort ¶
HostPort returns the Host header's hostname and explicit port ("" when the header names none).
func RequestLineHasScheme ¶
RequestLineHasScheme reports whether the request line uses absolute-form (an explicit http(s):// on the request target), in which case the scheme is already pinned and needs no inference.
Types ¶
type Options ¶
type Options struct {
// Pinned: the caller overrode the target URL (-t, target_url), so the
// request already carries the operator's scheme and is never probed.
Pinned bool
// NoProbe keeps the inferred https default without contacting the target
// (--no-scheme-probe, no_scheme_probe; also a scope-refused target).
NoProbe bool
// Resolver replaces portsweep.ResolveScheme (tests). Nil = the real probe.
Resolver Resolver
}
Options tunes Settle.
type Resolver ¶
type Resolver func(ctx context.Context, host, port, rest string, opts portsweep.SchemeOptions) portsweep.SchemeResolution
Resolver is the network question behind the probe (portsweep.ResolveScheme).
type Result ¶
type Result struct {
// Request is the request to scan: the input, or a rebuild of it when the
// probe chose a different scheme or port.
Request *httpmsg.HttpRequestResponse
// Source is one of the Source* values ("" for a nil request).
Source string
// Header is the header that decided an origin/referer Source, as written
// ("Origin", "Referer").
Header string
// Scheme is the scheme the request is sent with.
Scheme string
// Host and Port are the Host header's hostname and explicit port (Port is
// "" when the header names none).
Host, Port string
// Authority is host:port of the inferred service (before any probe).
Authority string
// ProbedAuthority is host:port the probe settled (Source probe only).
ProbedAuthority string
// Changed reports that Request differs from the input request.
Changed bool
}
Result is a settled request and what settled it.
func Settle ¶
Settle returns the request to scan and what decided its scheme. raw is the normalized raw request the input was parsed from; "" (a curl command, which carries its URL) is explicit, as is a pinned request.
func (Result) ExplicitPort ¶
ExplicitPort reports whether the Host header named a port.
Source Files