Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I want to test our DOS prevention system against http requests that are not have header and agent information. Is there any tool I can do that. I tried siege with this command

siege -c 3 -b -H "Host: " -A ""  http://10.0.1.2/

This command sends requests with empty host and agent values. What I want is to send requests without defining host and agent values.

Thanks for any advice...

share|improve this question

3 Answers 3

up vote 3 down vote accepted

Worst case, you could use netcat.

nc example.com 80 << http_message_file

where example.com is the host to which you want to connect, 80 is the port to which you want to connect (I chose 80 since that's typical HTTP server port) and http_message_file contains the exact HTTP request you want to send, such as

GET /path/to/resource HTTP/1.1
Host: example.com
share|improve this answer
    
Nice answer. Don't forget to put "\r\n\r\n" at the end of header ;) –  ibrahim Jan 8 '14 at 7:47
    
@atk Thanks you've helped me answer: stackoverflow.com/questions/27350838/… nc example.com 80 << http_message_file Did not load the request in the file, rather let me type it using a here DOC. cat http_message_file | nc example.com 80 Did the trick –  user2514583 Dec 29 '14 at 2:18

I don't know if this will work for you, but why not. You can easely use python to send requests as you whish like so:

import urllib
import urllib2

url = 'http://www.someserver.com/cgi-bin/register.cgi'
user_agent = 'Mozilla/4.0 (compatible; MSIE 5.5; Windows NT)'
values = {'name' : 'Michael Foord',
          'location' : 'Northampton',
          'language' : 'Python' }
headers = { 'User-Agent' : user_agent }

data = urllib.urlencode(values)
req = urllib2.Request(url, data, headers)
response = urllib2.urlopen(req)
the_page = response.read()

From python doc : http://docs.python.org/2/howto/urllib2.html#headers

Try doing the same thing but with empty user_agent and Headers, it worked in my smal test.

Here is the snippet I tested:

import urllib
import urllib2

url = 'http://www.someserver.com/cgi-bin/register.cgi'
user_agent = ''
values = ''
headers = { '' : '' }

data = urllib.urlencode(values)
req = urllib2.Request(url, data, headers)
response = urllib2.urlopen(req)
the_page = response.read()
share|improve this answer

I'm surprised nobody mentioned the easiest way of doing this, with curl :

curl -H "User-Agent:" -H "Host:" http://10.0.1.2/

The -H argument can be used to set custom headers or to remove them by setting no value on them.

Example of what that command does on my site, with -v added for verbosity :

andre@network ~ % curl -H "User-Agent:" -H "Host:" http://andredaniel.me -v
* Rebuilt URL to: http://andredaniel.me/
* Hostname was NOT found in DNS cache
*   Trying 2a01:7e00::f03c:91ff:fe89:63c8...
* connect to 2a01:7e00::f03c:91ff:fe89:63c8 port 80 failed: Connection refused
*   Trying 85.159.208.85...
* Connected to andredaniel.me (85.159.208.85) port 80 (#0)
> GET / HTTP/1.1
> Accept: */*
>
< HTTP/1.1 400 Bad Request
< Server: nginx/1.6.2
< Date: Mon, 29 Dec 2014 13:09:44 GMT
< Content-Type: text/html; charset=utf-8
< Content-Length: 172
< Connection: close
<
[page contents truncated]

As you can see, both the host and user-agent headers are missing and the web server doesn't like that very much because I use virtual hosts and the host header is essential in that case.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.