This is my first time asking for some support in my case. Please forgive me, as I am still learning... The scenario is really simple:
Some device with HTTP server is being fuzzed by metasploit's module (http_get_uri_long) which requests long URIs and awaits for response. The HTTP server crashes when receiving about 1700 chars of URI, completely freezing the device until it is restarted manually by unplugging it from power socket. I have made multiple tests, and always when HTTP server receives "GET /XXXX..." (about 1700 of Xs) the device freezes which confirms the bug exists.
However, upon creating a simple PoC in Python (2.7) using socket module, I am requesting the same amount of Xs within URI, but without my goal (freezing the device). For shorter URI, normal 404 error is returned. But when requesting longer URIs, HTTP server doesn't reponse with anything. And the device is still up.
I have tried wireshark, to check if (maybe) I made something wrong within my PoC code, but the packets seems to be same.
Here is my PoC:
import socket s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) ip = "192.168.0.11" port = 80 s.connect((ip,port)) data = "GET /" + 'X' * 1800 + " HTTP/1.1\r\nHost: %s\r\n\r\n" % ip print data s.send(data) print s.recv(4096) s.close()
My goal is: achieve same result as MSF's HTTP URI fuzzer, means freezing up the device. The problem is I cannot reproduce the same with my python code.
Any help is greatly appreciated :)