id: request-based-interaction

info:
  name: OOB Request Based Interaction
  author: pdteam
  severity: info
  description: The remote server fetched a spoofed DNS Name from the request.
  reference:
    - https://portswigger.net/research/cracking-the-lens-targeting-https-hidden-attack-surface
  metadata:
    max-request: 5
  tags: oast,ssrf,generic

http:
  - raw:
      - |+
        GET / HTTP/1.1
        Host: {{interactsh-url}}
        Cache-Control: no-transform
        Accept: */*

      - |+
        GET / HTTP/1.1
        Host: @{{interactsh-url}}
        Cache-Control: no-transform
        Accept: */*

      - |+
        GET http://{{interactsh-url}}/ HTTP/1.1
        Host: {{Hostname}}
        Cache-Control: no-transform
        Accept: */*

      - |+
        GET @{{interactsh-url}}/ HTTP/1.1
        Host: {{Hostname}}
        Cache-Control: no-transform
        Accept: */*

      - |+
        GET {{interactsh-url}}:80/ HTTP/1.1
        Host: {{Hostname}}
        Cache-Control: no-transform
        Accept: */*

    unsafe: true # Use Unsafe HTTP library for malformed HTTP requests.

    matchers-condition: or
    matchers:
      - type: word
        part: interactsh_protocol
        name: http
        words:
          - "http"

      - type: word
        part: interactsh_protocol
        name: dns
        words:
          - "dns"
# digest: 4b0a00483046022100ca4916bbf7327c1cd65b48ba5243ff714d5beefa994a0069b2d40ab1b97cdd78022100d1714c05ea0264cda4eaebee4d90f3aa1786ece75107b655fc267c82080f7d20:922c64590222798bb761d5b6d8e72950