header fuzzing support in http templates

v2/pkg/protocols/common/fuzz/execute.go

@@ -9,7 +9,6 @@ import (
 	"github.com/projectdiscovery/nuclei/v2/pkg/protocols/common/contextargs"
 	"github.com/projectdiscovery/nuclei/v2/pkg/protocols/common/generators"
 	"github.com/projectdiscovery/retryablehttp-go"
-	urlutil "github.com/projectdiscovery/utils/url"
 )
 
 // ExecuteRuleInput is the input for rule Execute function
@@ -42,7 +41,7 @@ type GeneratedRequest struct {
 // Input is not thread safe and should not be shared between concurrent
 // goroutines.
 func (rule *Rule) Execute(input *ExecuteRuleInput) error {
-	if !rule.isExecutable(input.Input) {
+	if !rule.isExecutable(input.BaseRequest) {
 		return nil
 	}
 	baseValues := input.Values
@@ -70,12 +69,11 @@ func (rule *Rule) Execute(input *ExecuteRuleInput) error {
 }
 
 // isExecutable returns true if the rule can be executed based on provided input
-func (rule *Rule) isExecutable(input *contextargs.Context) bool {
-	parsed, err := urlutil.Parse(input.MetaInput.Input)
-	if err != nil {
-		return false
+func (rule *Rule) isExecutable(req *retryablehttp.Request) bool {
+	if !req.Query().IsEmpty() && rule.partType == queryPartType {
+		return true
 	}
-	if !parsed.Query().IsEmpty() && rule.partType == queryPartType {
+	if len(req.Header) > 0 && rule.partType == headersPartType {
 		return true
 	}
 	return false

v2/pkg/protocols/common/fuzz/execute_test.go

@@ -1,9 +1,9 @@
 package fuzz
 
 import (
+	"github.com/projectdiscovery/retryablehttp-go"
 	"testing"
 
-	"github.com/projectdiscovery/nuclei/v2/pkg/protocols/common/contextargs"
 	"github.com/stretchr/testify/require"
 )
 
@@ -12,11 +12,15 @@ func TestRuleIsExecutable(t *testing.T) {
 	err := rule.Compile(nil, nil)
 	require.NoError(t, err, "could not compile rule")
 
-	input := contextargs.NewWithInput("https://example.com/?url=localhost")
-	result := rule.isExecutable(input)
+	req, err := retryablehttp.NewRequest("GET", "https://example.com/?url=localhost", nil)
+	require.NoError(t, err, "could not build request")
+
+	result := rule.isExecutable(req)
 	require.True(t, result, "could not get correct result")
 
-	input = contextargs.NewWithInput("https://example.com/")
-	result = rule.isExecutable(input)
+	req, err = retryablehttp.NewRequest("GET", "https://example.com/", nil)
+	require.NoError(t, err, "could not build request")
+
+	result = rule.isExecutable(req)
 	require.False(t, result, "could not get correct result")
 }

v2/pkg/protocols/common/fuzz/fuzz.go

@@ -99,10 +99,12 @@ type partType int
 
 const (
 	queryPartType partType = iota + 1
+	headersPartType
 )
 
 var stringToPartType = map[string]partType{
-	"query": queryPartType,
+	"query":   queryPartType,
+	"headers": headersPartType,
 }
 
 // modeType is the mode of rule enum declaration

v2/pkg/protocols/common/fuzz/parts.go

@@ -2,6 +2,9 @@ package fuzz
 
 import (
 	"context"
+	"github.com/pkg/errors"
+	"github.com/projectdiscovery/gologger"
+	"io"
 	"net/http"
 	"strings"
 
@@ -19,6 +22,46 @@ func (rule *Rule) executePartRule(input *ExecuteRuleInput, payload string) error
 	switch rule.partType {
 	case queryPartType:
 		return rule.executeQueryPartRule(input, payload)
+	case headersPartType:
+		return rule.executeHeadersPartRule(input, payload)
+	}
+	return nil
+}
+
+// executeHeadersPartRule executes headers part rules
+func (rule *Rule) executeHeadersPartRule(input *ExecuteRuleInput, payload string) error {
+	// clone the request to avoid modifying the original
+	originalRequest := input.BaseRequest
+	req := originalRequest.Clone(context.TODO())
+	// Also clone headers
+	headers := req.Header.Clone()
+
+	for key, values := range originalRequest.Header {
+		cloned := sliceutil.Clone(values)
+		for i, value := range values {
+			if !rule.matchKeyOrValue(key, value) {
+				continue
+			}
+			var evaluated string
+			evaluated, input.InteractURLs = rule.executeEvaluate(input, key, value, payload, input.InteractURLs)
+			cloned[i] = evaluated
+
+			if rule.modeType == singleModeType {
+				headers[key] = cloned
+				if err := rule.buildHeadersInput(input, headers, input.InteractURLs); err != nil {
+					gologger.Error().Msgf("Could not build request for headers part rule %v: %s\n", rule, err)
+					return err
+				}
+				cloned[i] = value // change back to previous value for headers
+			}
+		}
+		headers[key] = cloned
+	}
+
+	if rule.modeType == multipleModeType {
+		if err := rule.buildHeadersInput(input, headers, input.InteractURLs); err != nil {
+			return err
+		}
 	}
 	return nil
 }
@@ -67,6 +110,28 @@ func (rule *Rule) executeQueryPartRule(input *ExecuteRuleInput, payload string)
 	return err
 }
 
+// buildHeadersInput returns created request for a Headers Input
+func (rule *Rule) buildHeadersInput(input *ExecuteRuleInput, headers http.Header, interactURLs []string) error {
+	var req *retryablehttp.Request
+	if input.BaseRequest == nil {
+		return errors.New("Base request cannot be null when fuzzing headers")
+	} else {
+		req = input.BaseRequest.Clone(context.TODO())
+		req.Header = headers
+		// If we modify Host header we also should change this property
+		req.Host = headers.Get("Host")
+	}
+	request := GeneratedRequest{
+		Request:       req,
+		InteractURLs:  interactURLs,
+		DynamicValues: input.Values,
+	}
+	if !input.Callback(request) {
+		return io.EOF
+	}
+	return nil
+}
+
 // buildQueryInput returns created request for a Query Input
 func (rule *Rule) buildQueryInput(input *ExecuteRuleInput, parsed *urlutil.URL, interactURLs []string) error {
 	var req *retryablehttp.Request

v2/pkg/protocols/common/fuzz/parts_test.go

@@ -1,6 +1,8 @@
 package fuzz
 
 import (
+	"github.com/projectdiscovery/retryablehttp-go"
+	"net/http"
 	"testing"
 
 	"github.com/projectdiscovery/nuclei/v2/pkg/protocols"
@@ -9,6 +11,68 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
+func TestExecuteHeadersPartRule(t *testing.T) {
+	options := &protocols.ExecutorOptions{
+		Interactsh: &interactsh.Client{},
+	}
+	req, err := retryablehttp.NewRequest("GET", "http://localhost:8080/", nil)
+	require.NoError(t, err, "can't build request")
+
+	req.Header.Set("X-Custom-Foo", "foo")
+	req.Header.Set("X-Custom-Bar", "bar")
+
+	t.Run("single", func(t *testing.T) {
+		rule := &Rule{
+			ruleType: postfixRuleType,
+			partType: headersPartType,
+			modeType: singleModeType,
+			options:  options,
+		}
+		var generatedHeaders []http.Header
+		err := rule.executeHeadersPartRule(&ExecuteRuleInput{
+			Input:       contextargs.New(),
+			BaseRequest: req,
+			Callback: func(gr GeneratedRequest) bool {
+				generatedHeaders = append(generatedHeaders, gr.Request.Header.Clone())
+				return true
+			},
+		}, "1337'")
+		require.NoError(t, err, "could not execute part rule")
+		require.ElementsMatch(t, []http.Header{
+			{
+				"X-Custom-Foo": {"foo1337'"},
+				"X-Custom-Bar": {"bar"},
+			},
+			{
+				"X-Custom-Foo": {"foo"},
+				"X-Custom-Bar": {"bar1337'"},
+			},
+		}, generatedHeaders, "could not get generated headers")
+	})
+
+	t.Run("multiple", func(t *testing.T) {
+		rule := &Rule{
+			ruleType: postfixRuleType,
+			partType: headersPartType,
+			modeType: multipleModeType,
+			options:  options,
+		}
+		var generatedHeaders http.Header
+		err := rule.executeHeadersPartRule(&ExecuteRuleInput{
+			Input:       contextargs.New(),
+			BaseRequest: req,
+			Callback: func(gr GeneratedRequest) bool {
+				generatedHeaders = gr.Request.Header.Clone()
+				return true
+			},
+		}, "1337'")
+		require.NoError(t, err, "could not execute part rule")
+		require.Equal(t, http.Header{
+			"X-Custom-Foo": {"foo1337'"},
+			"X-Custom-Bar": {"bar1337'"},
+		}, generatedHeaders, "could not get generated headers")
+	})
+}
 func TestExecuteQueryPartRule(t *testing.T) {
 	URL := "http://localhost:8080/?url=localhost&mode=multiple&file=passwdfile"
 	options := &protocols.ExecutorOptions{

v2/pkg/protocols/headless/request.go

@@ -2,6 +2,7 @@ package headless
 
 import (
 	"fmt"
+	"github.com/projectdiscovery/retryablehttp-go"
 	"net/url"
 	"strings"
 	"time"
@@ -211,12 +212,16 @@ func (request *Request) executeFuzzingRule(input *contextargs.Context, payloads
 	if _, err := urlutil.Parse(input.MetaInput.Input); err != nil {
 		return errors.Wrap(err, "could not parse url")
 	}
+	baseRequest, err := retryablehttp.NewRequest("GET", input.MetaInput.Input, nil)
+	if err != nil {
+		return errors.Wrap(err, "could not create base request")
+	}
 	for _, rule := range request.Fuzzing {
 		err := rule.Execute(&fuzz.ExecuteRuleInput{
 			Input:       input,
 			Callback:    fuzzRequestCallback,
 			Values:      payloads,
-			BaseRequest: nil,
+			BaseRequest: baseRequest,
 		})
 		if err == types.ErrNoMoreRequests {
 			return nil

v2/pkg/protocols/http/request.go

@@ -229,8 +229,12 @@ func (request *Request) executeTurboHTTP(input *contextargs.Context, dynamicValu
 
 // executeFuzzingRule executes fuzzing request for a URL
 func (request *Request) executeFuzzingRule(input *contextargs.Context, previous output.InternalEvent, callback protocols.OutputEventCallback) error {
-	if _, err := urlutil.Parse(input.MetaInput.Input); err != nil {
-		return errors.Wrap(err, "could not parse url")
+	// If request is self-contained we don't need to parse any input.
+	if !request.SelfContained {
+		// If it's not self-contained we parse user provided input
+		if _, err := urlutil.Parse(input.MetaInput.Input); err != nil {
+			return errors.Wrap(err, "could not parse url")
+		}
 	}
 	fuzzRequestCallback := func(gr fuzz.GeneratedRequest) bool {
 		hasInteractMatchers := interactsh.HasMatchers(request.CompiledOperators)