Option Reference

These are the main options accepted by send_request_cgi / request_cgi. The sources are Rex::Proto::Http::Client#request_raw / #request_cgi and HttpClient itself.

Request line and connection

Key	Type	Meaning	Typical default
method	String	HTTP method	GET
uri	String	Path	Effectively required
version	String	HTTP version	1.1
proto	String	Protocol name	HTTP
vhost	String	Host header	datastore VHOST / rhost
rhost	String	Override connection host	datastore
rport	Integer	Override connection port	datastore
SSL	Bool	Override TLS setting	datastore
agent	String	User-Agent	datastore UserAgent
connection	String	Connection header
encode	Bool	Encode the URI itself	false
partial	Bool	Return incomplete responses too	false

Parameters and body

Key	Type	Meaning
vars_get	Hash	Query parameters
vars_post	Hash	Form POST parameters
vars_form_data	Array<Hash>	Multipart field array
vars_form_data_boundary	String	Multipart boundary (normally automatic)
query	String	Raw query string (alternative to vars_get)
data	String	Raw body
ctype	String	Content-Type
encode_params	Bool	URI-encode GET / POST parameters (defaults to true)

Headers, authentication, and cookies

Key	Type	Meaning
headers	Hash	Additional headers
raw_headers	String	Raw header string
authorization	String	Authorization header value
cookie	String / HttpCookieJar	Cookie header
keep_cookies	Bool	Add Set-Cookie values to the cookie jar
expire_cookies	Bool	Remove expired entries from the cookie jar before use (enabled by default; disable with false)
username / password	String	Client authentication credentials (on connection)
preferred_auth	String	Basic / Digest / NTLM / Kerberos / Negotiate / None

Related HttpClient datastore options

These take effect as module options rather than entries in the request Hash.

Option	Effect
HttpUsername / HttpPassword	User credentials for the connection
HttpClientTimeout	Timeout in seconds
HttpTrace / HttpTraceHeadersOnly	Debug output
HttpRawHeaders	Extra headers file using an ERB template
UserAgent	Default User-Agent
DOMAIN	NTLM / Kerberos
HTTP::Auth	Authentication method
HTTP::uri_encode_mode and others	Evasion settings

Minimal example

send_request_cgi(
  'method' => 'GET',
  'uri' => '/',
  'vars_get' => { 'a' => '1' },
  'headers' => { 'Accept' => 'text/plain' },
  'vhost' => 'app.htb'
)