Metasploit mailing list archives

Metasploit v3.0-alpha-r3 lib/rex/proto/http/client.rb vhost bug with some webservers


From: hfortier at recon.cx (Hugo Fortier)
Date: Tue, 18 Apr 2006 14:26:36 -0400

In lib/rex/proto/http/client.rb at line 117
                   req['Host'] = (self.request_config['vhost'] || self.hostname)  
+ ':' + self.port.to_s

The port number are getting automatically added to the "Host:"  
header, so if you say that the vhost = localhost and the webserver  
use the default port it create the host header as "Host: localhost:80".

I believe this should be optional in the framework and if you want  
the port number it should be included in the hostname (as  
vhost="localhost:80"). Some webservers (lighttpd for example) will  
not recognize the the virtual host correctly if it's followed by the  
port number.

Hugo



Current thread: