Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allow HttpClient to remember my cookie #2697

Closed
wants to merge 1 commit into from

Conversation

wchen-r7
Copy link
Contributor

When the target host sets a cookie, the Httpclient should remember it. That way in the module I won't have to manually extract it, and then put it in the next request.

If some for reason the module decides to send to different hosts, the HttpClient mixin should know which one to use. Also, as you can see only send_request_cgi() uses this feature, I don't think send_request_raw should be using it because it's supposed to be the most basic form of send_request_*.

For testing, use test/modules/auxiliary/test/cookie_test.rb, and then you'll have to use wireshark to verify it's working properly. You can set the rhost to 208.118.237.137 if you want, that's metasploit.com.

[SeeRM #8706]

When the target host sets a cookie, the Httpclient should remember
it. That way in the module I won't have to manually extract it,
and then put it in the next request.

If some for reason the module decides to send to different hosts,
the HttpClient mixin should know which one to use.
@jvennix-r7
Copy link
Contributor

This PR looks useful but I see a couple things wrong:

  • cookies need to be split and stored as key-value
  • Set-cookie needs to behave like "replace-or-append" on a per-key basis, instead of "replace-all" approach now

Cookie jar implementations I have seen are not so simple, the spec is pretty long. Probably easiest to use a pre-existing gem to handle parsing/storing/serializing client-side cookies. This one looks minimal, tested, spec-compliant, and is MIT-licensed: https://github.com/sparklemotion/http-cookie

@wchen-r7
Copy link
Contributor Author

wchen-r7 commented Dec 2, 2013

Awright, let's close this one.

@wchen-r7 wchen-r7 closed this Dec 2, 2013
@wchen-r7 wchen-r7 deleted the http_client_cookies branch August 22, 2016 16:31
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants