fix little issues

[AlessandroZ]

Hi,

I had some issues using your script so I fixed it:

• adding a try/except on the extractDatas function (I get a stracktrace)
• t_urlparse.netloc return [ip]:[port] so if your url is composed using [ip]:[port], sock.connect( (t_urlparse.netloc, port) ) will fail
• the url printed was always the same on the error when using -u [url_list] because the url printed wasn't the good one.
• adding custom data wasn't added to the base http header

I didn't add but I think it would be easy to add new techniques described here:

• https://portswigger.net/research/breaking-the-chains-on-http-request-smuggler

Such as:

Transfer-Encoding: identity, chunked

Or adding some pads to get a request over than 40kb:

• https://github.com/PortSwigger/http-request-smuggler/blob/master/src/burp/SmuggleScanBox.java#L374

Thanks for your work. Have a nice day !

[gwen001]

I didn't merge your pull request, I'm not confortable with that but I added all your fixes.

Also added "identify" keyword and chunky (padding) as a new method but not as an overall option.
I have to refactor the code to not play with strings manipulation anymore, it's so crap.
Anyway thank you for the feedback.

If you have any idea of what do vanilla and reversevanilla method I would be happy to write them. Thanks again :)

[AlessandroZ]

vanilla method seems to be a basic check without any modification.
Disable all options from the burp HTTP Request smuggling plugin and enable only "vanilla". You can see with logger++ 4 requests sent:

Content-Length: 5
Transfer-Encoding: chunked

0

Content-Length: 11
Transfer-Encoding: chunked

1
Z
Q

Content-Length: 5
Transfer-Encoding: chunked

1
Z

Content-Length: 6
Transfer-Encoding: chunked

0

X

For the reverse vanilla, it seems to be disabled on the burp plugin: https://github.com/PortSwigger/http-request-smuggler/blob/master/src/burp/SmuggleScanBox.java#L62

[gwen001]

Yeah yeah it's exactly what I tried and I didn't notice anything so I though there was a kind of magic I couldn't understand. :)