HttpClient

Metasploit

Msf::Exploit::Remote::HttpClient is the main HTTP(S) client mixin. Its implementation is lib/msf/core/exploit/remote/http_client.rb.

include

include Msf::Exploit::Remote::HttpClient

The main options it adds automatically are:

Option	Meaning
`RHOST` / `RPORT`	Destination
`VHOST`	Host header / virtual host
`SSL`	Whether to use TLS
`Proxies`	Proxy settings
`UserAgent`	User-Agent
`HttpUsername` / `HttpPassword`	Client authentication
`HttpClientTimeout`	Timeout
`HttpTrace`	Show raw requests and responses
`DOMAIN`	NTLM / Kerberos
`HTTP::*`	Evasion settings

Main APIs

Method	Purpose
`send_request_cgi(opts, timeout=20, disconnect=true)`	CGI-compatible request
`send_request_raw(opts, timeout=20, disconnect=false)`	Raw or nonstandard request
`send_request_cgi!(opts, timeout=20, redirect_depth=1)`	Follow redirects
`basic_auth(user, pass)`	Authorization value for Basic authentication
`normalize_uri(*parts)`	Join path components
`target_uri`	URI object for `TARGETURI`
`full_uri`	Absolute URL string
`connect` / `disconnect`	Explicit connection management
`rhost` / `rport` / `peer` / `vhost` / `ssl`	Connection-information helpers
`http_fingerprint`	Server fingerprint

Examples

def check
  res = send_request_cgi(
    'method' => 'GET',
    'uri' => normalize_uri(target_uri.path, 'index.php')
  )
  return CheckCode::Unknown('no response') if res.nil?
  return CheckCode::Appears if res.body.include?('ExampleApp')
  CheckCode::Safe
end

# When reusing a connection
connect
res1 = send_request_cgi('uri' => '/', 'method' => 'GET')
res2 = send_request_cgi('uri' => '/admin', 'method' => 'GET')
disconnect

# Debugging
# set HttpTrace true
# set HttpTraceHeadersOnly true

Common patterns

Pattern	Approach
Single GET	`send_request_cgi('method'=>'GET', 'uri'=>...)`
Continued form login	Set `keep_cookies: true`, then send regular requests
Basic authentication	`'authorization' => basic_auth(u, p)`
JSON API	`'ctype'=>'application/json', 'data'=>hash.to_json`
Multipart upload	`vars_form_data` or `Rex::MIME::Message`
Follow redirects	`send_request_cgi!`
Nonstandard HTTP	`send_request_raw`
Reuse a connection	`connect` → Multiple requests → `disconnect`
Fingerprint	`http_fingerprint` / `HttpFingerprint` constant

For all request options, see send_request_cgi. URI helpers are covered in URI Helpers.