Skip to content

Raw Request Bug [304 Response = i/o timeout] #98

New issue
New issue
Closed
#138
Closed
Raw Request Bug [304 Response = i/o timeout]#98
#138
Labels
Status: CompletedNothing further to be done with this issue. Awaiting to be closed.Type: BugInconsistencies or issues which will cause an issue or problem for users or implementors.

Description

@Impact-I
Impact-I
opened on Feb 26, 2023

Sorry, but the example with nuclei is easier for me

Nuclei version:

[INF] Current Version: 2.8.9

Current Behavior:

When sending an unprocessed request with a 'If-Modified-sinCe' header, no response is received and the request goes into a long timeout.

Expected Behavior:

An raw request must receive a valid response.

Steps To Reproduce:

Template:

id: C
info:
  name: C
  author: C
  description: C
 
requests:
  - raw:
      - |+
        GET /service-worker.js HTTP/1.1
        Host: rutube.ru
        If-Modified-Since: Tue, 21 Feb 2023 14:51:35 GMT

    unsafe: true

Command:

./nuclei -debug -t temple.yaml -u https://rutube.ru
  1. Notice that instead of response
HTTP/1.1 304 Not Modified
Connection: close
Cache-Control: max-age=0
Date: Sat, 25 Feb 2023 17:42:57 GMT
Last-Modified: Tue, 21 Feb 2023 14:51:35 GMT
Server: QRATOR
Set-Cookie: uuid=94823265-14f0-d067-34b0-180e;

we get exception could not read http body: read tcp 192.168.1.1:8080->198.248.233.148:443: i/o timeout

You can remove unsafe: true from the yaml file to see the correct response.
OS: Windows 10, Ubuntu 18.04

Activity

  1. Impact-I
    added
    Type: BugInconsistencies or issues which will cause an issue or problem for users or implementors.
    on Feb 26, 2023

  2. Impact-I commented on Apr 6, 2023

    @Impact-I
    Impact-I
    on Apr 6, 2023
    Author

    Possible Fix:
    projectdiscovery/nuclei#3360 (comment)

    diff --git a/client/status.go b/client/status.go
index ecc1525..a371452 100644
--- a/client/status.go
+++ b/client/status.go
 func (s Status) IsRedirect() bool {
+       // Per RFC 9110 section 15.4.5 a 304 response is terminated by the end of the header section; it cannot contain content or trailers.
+       if s.Code == REDIRECTION_NOT_MODIFIED {
+               return false
+       }
        return s.Code >= REDIRECTION_MULTIPLE_CHOICES && s.Code < CLIENT_ERROR_BAD_REQUEST
 }
 func (s Status) IsError() bool { return s.Code >= CLIENT_ERROR_BAD_REQUEST }

  3. jimen0 commented on Apr 6, 2023

    @jimen0
    jimen0
    on Apr 6, 2023

    Note fixing this in nuclei requires some additional changes in httpx. Refer to the linked comment.

  4. ehsandeep
    linked a pull request that will close this issueHandling status code 304 with body #138on Jun 20, 2023
  5. ehsandeep
    added
    Status: CompletedNothing further to be done with this issue. Awaiting to be closed.
    on Jun 20, 2023
  6. ehsandeep
    closed this as completedon Jun 20, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    Status: CompletedNothing further to be done with this issue. Awaiting to be closed.Type: BugInconsistencies or issues which will cause an issue or problem for users or implementors.

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions