Send a Blank Host

[random-robbie]

Hey,

Is it possible to send a request with a blank host i.e like

GET /
Host:
Accept-Encoding: gzip, deflate
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Connection: close

[random-robbie]

Found the answer but i think it breaks and does not send the request.

requests:
  - raw:
      - |
        GET /
        Host:   
        Accept-Encoding: gzip, deflate
        Accept: */*
        Accept-Language: en
        User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
        Connection: close
    
    unsafe: true
    matchers:
      - type: word
        part: body
        words:
          - "http"
          

[geeknik]

If you use the -debug -v flags as part of your nuclei command line, you'll be able to view the raw request and see what is happening behind the scenes.

[ehsandeep]

See

nuclei-templates/cves/2018/CVE-2018-18778.yaml

Lines 23 to 25 in 2a44b0c

	Host:
	unsafe: true

@random-robbie unsafe: true for doing any non-standard stuff.

[lcyh]

已收到，谢谢