diff --git a/common/httpx/httpx.go b/common/httpx/httpx.go index 6d3ee165f..2e59bb6f9 100644 --- a/common/httpx/httpx.go +++ b/common/httpx/httpx.go @@ -75,6 +75,27 @@ func New(options *Options) (*HTTPX, error) { redirectFunc = func(redirectedRequest *http.Request, previousRequests []*http.Request) error { // add custom cookies if necessary httpx.setCustomCookies(redirectedRequest) + + //Add redirect policy which takes HSTS into account. + //Since the net/http/client doesn't take it into account + //it is possible to modify it here. + //If during redirect the scheme switches from HTTPS to HTTP + //but the Strict-Transport-Security header is present the request + //would go to the specified location. This could mean that it is not + //followed the same way as a browser. There exist some cases in the wild. + if httpx.Options.RespectHSTS { + location := redirectedRequest.Response.Header.Get("Location") + hsts := redirectedRequest.Response.Header.Get("Strict-Transport-Security") + url, err := redirectedRequest.URL.Parse(location) + if err != nil { + } else { + if url.Scheme == "http" && hsts != "" { + url.Scheme = "https" + } + } + redirectedRequest.URL = url + } + if len(previousRequests) >= options.MaxRedirects { // https://github.com/golang/go/issues/10069 return http.ErrUseLastResponse diff --git a/common/httpx/option.go b/common/httpx/option.go index 352b985d9..f1de106d7 100644 --- a/common/httpx/option.go +++ b/common/httpx/option.go @@ -24,6 +24,7 @@ type Options struct { VHostSimilarityRatio int FollowRedirects bool FollowHostRedirects bool + RespectHSTS bool MaxRedirects int Unsafe bool TLSGrab bool diff --git a/runner/options.go b/runner/options.go index c6859bebe..22c21762e 100644 --- a/runner/options.go +++ b/runner/options.go @@ -186,6 +186,7 @@ type Options struct { Location bool ContentLength bool FollowRedirects bool + RespectHSTS bool StoreResponse bool JSONOutput bool CSVOutput bool @@ -409,6 +410,7 @@ func ParseOptions() *Options { flagSet.BoolVarP(&options.FollowRedirects, "follow-redirects", "fr", false, "follow http redirects"), flagSet.IntVarP(&options.MaxRedirects, "max-redirects", "maxr", 10, "max number of redirects to follow per host"), flagSet.BoolVarP(&options.FollowHostRedirects, "follow-host-redirects", "fhr", false, "follow redirects on the same host"), + flagSet.BoolVarP(&options.RespectHSTS, "respect-hsts", "rhsts", false, "respect HSTS response headers for redirect requests"), flagSet.BoolVar(&options.VHostInput, "vhost-input", false, "get a list of vhosts as input"), flagSet.StringVar(&options.Methods, "x", "", "request methods to probe, use 'all' to probe all HTTP methods"), flagSet.StringVar(&options.RequestBody, "body", "", "post body to include in http request"), diff --git a/runner/runner.go b/runner/runner.go index e8e8a44d0..9700a0826 100644 --- a/runner/runner.go +++ b/runner/runner.go @@ -106,6 +106,7 @@ func New(options *Options) (*Runner, error) { httpxOptions.RetryMax = options.Retries httpxOptions.FollowRedirects = options.FollowRedirects httpxOptions.FollowHostRedirects = options.FollowHostRedirects + httpxOptions.RespectHSTS = options.RespectHSTS httpxOptions.MaxRedirects = options.MaxRedirects httpxOptions.HTTPProxy = options.HTTPProxy httpxOptions.Unsafe = options.Unsafe