HTTP Methods and Parameters

Patterns for HTTP methods and GET / POST parameters.

GET + vars_get

res = send_request_cgi(
  'method' => 'GET',
  'uri' => normalize_uri(target_uri.path, 'search'),
  'vars_get' => {
    'q' => 'admin',
    'page' => '1'
  }
)
# GET /app/search?q=admin&page=1

POST + vars_post

res = send_request_cgi(
  'method' => 'POST',
  'uri' => normalize_uri(target_uri.path, 'login.php'),
  'vars_post' => {
    'username' => datastore['USERNAME'],
    'password' => datastore['PASSWORD']
  }
)
# Content-Type: application/x-www-form-urlencoded is added automatically

When method is POST and ctype is omitted, application/x-www-form-urlencoded is added automatically. You do not need to specify ctype for registration or login form POSTs. To send JSON, use data and 'ctype' => 'application/json' instead of vars_post. See Body and Multipart for details.

Specify GET and POST parameters together

res = send_request_cgi(
  'method' => 'POST',
  'uri' => normalize_uri(target_uri.path, 'login.php'),
  'vars_get' => { 'lang' => 'en' },
  'vars_post' => {
    'username' => 'admin',
    'password' => 'admin'
  }
)
# POST /login.php?lang=en

Raw query string

Use this when you want to send an already assembled query without vars_get.

res = send_request_cgi(
  'method' => 'GET',
  'uri' => normalize_uri(target_uri.path, 'x'),
  'query' => 'a=1&b[]=2&b[]=3'
)

encode_params

The default is true, which URI-encodes names and values. Disable it to avoid double encoding or when the server requires raw values.

res = send_request_cgi(
  'method' => 'GET',
  'uri' => normalize_uri(target_uri.path, 'ping'),
  'encode_params' => false,
  'vars_get' => {
    'ip' => '127.0.0.1;id'
  }
)

PUT / DELETE / PATCH

send_request_cgi(
  'method' => 'PUT',
  'uri' => normalize_uri(target_uri.path, 'api', 'item', '1'),
  'ctype' => 'application/json',
  'data' => { 'name' => 'x' }.to_json
)

send_request_cgi(
  'method' => 'DELETE',
  'uri' => normalize_uri(target_uri.path, 'api', 'item', '1')
)

Array values and nesting

When a Hash value is an array, the implementation emits it repeatedly. If you need a nested structure, use JSON in data or build the query string yourself and pass it as query.

'vars_get' => {
  'id[]' => ['1', '2']
}

Specify the HTTP method in a header

For some WAF evasion or tunneling cases, leave the method as POST and put the actual method in a header.

send_request_cgi(
  'method' => 'POST',
  'uri' => normalize_uri(target_uri.path, 'api'),
  'headers' => {
    'X-HTTP-Method-Override' => 'DELETE'
  },
  'vars_post' => { 'id' => '1' }
)

Put a payload in a parameter

'vars_get' => { 'cmd' => payload.encoded }
'vars_post' => { 'template' => payload.encoded }
'headers' => { 'X-Forwarded-For' => payload.encoded }

For command injection, encapsulating it in execute_command makes it easier to reuse.