Jtof fap http methods

README.md

@@ -132,7 +132,7 @@ If `-m, --mode` is specified, you can select the desired bypass mode to run a sp
 For now, the following bypass mode(s) are supported:
 
 ```
-all, mid_paths, end_paths, case_substitution, char_encode, http_methods, http_versions, http_headers_scheme, http_headers_ip, http_headers_port
+all, mid_paths, end_paths, case_substitution, char_encode, http_methods, http_versions, http_headers_method, http_headers_scheme, http_headers_ip, http_headers_port
 ```
 
 Example: 

bypass_url_parser.py

@@ -122,6 +122,8 @@ def __init__(self, config_dict=None, verbose=False, debug=False, debug_class=Fal
                                                                    ext_logger=self.logger, debug=self.debug_class)
         self.const_http_methods = Tools.load_file_into_memory_list("payloads/const_http_methods.lst",
                                                                    ext_logger=self.logger, debug=self.debug_class)
+        self.const_header_methods = Tools.load_file_into_memory_list("payloads/const_header_methods.lst",
+                                                                     ext_logger=self.logger, debug=self.debug_class)
         self.const_header_schemes = Tools.load_file_into_memory_list("payloads/const_header_schemes.lst",
                                                                      ext_logger=self.logger, debug=self.debug_class)
         self.const_protos = Tools.load_file_into_memory_list("payloads/const_protos.lst",
@@ -207,7 +209,7 @@ def _generate_curls(self, url_obj: ParseResult):
         if item not in self.curl_items:
             self.curl_items.append(item)
 
-        # [http_methods] - Custom methods
+        # [http_methods] - Custom request methods (-X)
         if any(mode in ["all", "http_methods"] for mode in self.current_bypass_modes):
             for const_http_method in self.const_http_methods:
                 cmd = [*self.base_curl, "-X", const_http_method, target_url]
@@ -226,6 +228,16 @@ def _generate_curls(self, url_obj: ParseResult):
                 if item not in self.curl_items:
                     self.curl_items.append(item)
 
+        # [http_headers_method] - Custom methods
+        if any(mode in ["all", "http_headers_method"] for mode in self.current_bypass_modes):
+            for const_header_method in self.const_header_methods:
+                for const_http_method in self.const_http_methods:
+                    cmd = [*self.base_curl, "-H", f"{const_header_method}: {const_http_method}", target_url]
+                    item = CurlItem(url_obj, self.base_curl, cmd, bypass_mode="http_headers_method",
+                                    target_ip=url_public_ip, debug=self.debug, ext_logger=self.logger)
+                    if item not in self.curl_items:
+                        self.curl_items.append(item)
+
         # [http_headers_ip] - Custom host injection headers
         if any(mode in ["all", "http_headers_ip"] for mode in self.current_bypass_modes):
             commands = set()

payloads/const_header_methods.lst

@@ -0,0 +1,2 @@
+X-HTTP-Method
+X-HTTP-Method-Override

payloads/const_http_methods.lst

@@ -1,11 +1,35 @@
+ACL
+BIND
+CHECKIN
+CHECKOUT
 CONNECT
+COPY
+DELETE
 GET
+HEAD
+LABEL
+LINK
 LOCK
+MERGE
+MKCOL
+MOVE
 OPTIONS
+ORDERPATCH
 PATCH
 POST
 POUET
+PRI
+PROPFIND
+PROPPATCH
 PUT
+QUERY
+REBIND
+REPORT
+SEARCH
 TRACE
 TRACK
-UPDATE
+UNCHECKOUT
+UNLOCK
+UPDATE
+UPDATEREDIRECTREF
+VERSION-CONTROL