So in this lesson, we are going to understand about unsafe
HTTP draw request as we
have already seen raw request. We will now
see what are unsafe raw requests.
So these unsafe raw requests
are used for complete control and customization of
the request that we are going to send to the
bug Bounty programs Target.
This allows us to use any kind
of malformed request as well. This can
be super useful. If you are trying to approach
for finding one probabilities like crlf
or HTTP request
smuggling as well.
We can enable this by using unsafe colon
true through which nuclei will
automatically understand that we are trying to send an unsafe
raw request.
So in the Practical time, let's quickly jump on the
template and see how it can be written.
So you can see I have written an unsafe raw request.yml template
provided the ID block info block
request raw. We are
going to send the same request once again, but this time
in the header we have specified that we are sending
an unsafe HTTP request.
And you can also see I have enabled the unsafe colon
true flag as well.
Alright, so let's send this request quickly.
I'm going to remove the raw request and I'm
going to save.
And I'm going to send an unsafe raw request this time and hit
enter.
Let's go to perp suit.
And you can see we have received the unsafe raw
request as well.
As you can see over here. We are trying to
send a post request.
With the method as post that we
can confirm from here.
And we can also see you're sending a request to
a specific endpoint post with a custom
header, which is actify header hectify unsafe
HTTP search equals to Apple in the
body.
And you can see we got an error it says bad request
because this is an unsafe fraud request
that we have created. As I said previously this
can be super useful in identifying requests smuggling or
CRF based issues.
Thank you.