Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Curl table does not permit the inclusion of custom headers #6574

Closed
FritzX6 opened this issue Jul 31, 2020 · 5 comments
Closed

Curl table does not permit the inclusion of custom headers #6574

FritzX6 opened this issue Jul 31, 2020 · 5 comments

Comments

@FritzX6
Copy link
Contributor

FritzX6 commented Jul 31, 2020

Feature request

What new feature do you want?

Add new column header to curl table.

How is this new feature useful?

This column would permit the passing of custom headers which would enable the curl table to return the responses from endpoints which require a specific header. An example of which is Google's GCP metadata server:
https://cloud.google.com/compute/docs/storing-retrieving-metadata


Screenshot of required header documentation:
image

How can this be implemented?

I do not know the manner in which this would be added.

@directionless
Copy link
Member

I think we should have a google instance metadata table (or possible a generic cloud metadata table)

I'm much less sure about adding headers to curl. It has security implications we'd need to think through. (Oh look, someone wrote a blog post https://www.tenchisecurity.com/blog/abusing-the-osquery-curl-table-for-pivoting-into-cloud-environments)

@theopolis
Copy link
Member

I agree, we should create a table specific for this.

@directionless
Copy link
Member

For future search purposes, the header in question is Metadata-Flavour: Google

@pratiklotia
Copy link

Was a new table format ever created for this? Is there an issue tracking this? gcp_instance_metadata

@mwarkentin
Copy link

I opened #7924 for a dedicated table.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

5 participants