{"action":"created","issue":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/4926","labels_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/4926/labels{/name}","comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/4926/comments","events_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/4926/events","html_url":"https://github.com/rapid7/metasploit-framework/pull/4926","id":61069618,"number":4926,"title":"Add a plugin for making curl-like http requests","user":{"login":"zeroSteiner","id":2058303,"avatar_url":"https://avatars.githubusercontent.com/u/2058303?v=3","gravatar_id":"","url":"https://api.github.com/users/zeroSteiner","html_url":"https://github.com/zeroSteiner","followers_url":"https://api.github.com/users/zeroSteiner/followers","following_url":"https://api.github.com/users/zeroSteiner/following{/other_user}","gists_url":"https://api.github.com/users/zeroSteiner/gists{/gist_id}","starred_url":"https://api.github.com/users/zeroSteiner/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zeroSteiner/subscriptions","organizations_url":"https://api.github.com/users/zeroSteiner/orgs","repos_url":"https://api.github.com/users/zeroSteiner/repos","events_url":"https://api.github.com/users/zeroSteiner/events{/privacy}","received_events_url":"https://api.github.com/users/zeroSteiner/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/feature","name":"feature","color":"bfe5bf"}],"state":"open","locked":false,"assignee":{"login":"kernelsmith","id":620129,"avatar_url":"https://avatars.githubusercontent.com/u/620129?v=3","gravatar_id":"","url":"https://api.github.com/users/kernelsmith","html_url":"https://github.com/kernelsmith","followers_url":"https://api.github.com/users/kernelsmith/followers","following_url":"https://api.github.com/users/kernelsmith/following{/other_user}","gists_url":"https://api.github.com/users/kernelsmith/gists{/gist_id}","starred_url":"https://api.github.com/users/kernelsmith/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kernelsmith/subscriptions","organizations_url":"https://api.github.com/users/kernelsmith/orgs","repos_url":"https://api.github.com/users/kernelsmith/repos","events_url":"https://api.github.com/users/kernelsmith/events{/privacy}","received_events_url":"https://api.github.com/users/kernelsmith/received_events","type":"User","site_admin":false},"milestone":null,"comments":14,"created_at":"2015-03-13T13:58:22Z","updated_at":"2015-03-26T03:34:18Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/4926","html_url":"https://github.com/rapid7/metasploit-framework/pull/4926","diff_url":"https://github.com/rapid7/metasploit-framework/pull/4926.diff","patch_url":"https://github.com/rapid7/metasploit-framework/pull/4926.patch"},"body":"This PR introduces a requests plugin which supplies the ```http_request``` command. The purpose is to allow making raw http requests from within metasploit using a curl-like syntax that many people are familiar with. This uses the Rex HTTP client and thus supports the internal routing provided by metasploit. Some times users need to make a quick HTTP request over a pivoted host, this should help make that alot easier.\r\n\r\nI tried to add support for the most commonly used flags from curl.\r\n\r\nHelp menu showing all the flags and options:\r\n```\r\nmsf-git (S:0 J:0)> load requests\r\n[*] Successfully loaded plugin: Requests\r\nmsf-git (S:0 J:0)> http_request\r\nUsage: http_request [options] uri\r\n\r\nOPTIONS:\r\n\r\n    -0        Use HTTP 1.0\r\n    -1        Use TLSv1 (SSL)\r\n    -2        Use SSLv2 (SSL)\r\n    -3        Use SSLv3 (SSL)\r\n    -A <opt>  User-Agent to send to server\r\n    -G        Send the -d data with an HTTP GET\r\n    -H <opt>  Custom header to pass to server\r\n    -I        Show document info only\r\n    -X <opt>  Request method to use\r\n    -d <opt>  HTTP POST data\r\n    -h        This help text\r\n    -i        Include headers in the output\r\n    -o <opt>  Write output to <file> instead of stdout\r\n    -u <opt>  Server user and password\r\n\r\n\r\nmsf-git (S:0 J:0)>\r\n```\r\n\r\nExamples (using the [Github API](https://developer.github.com/v3/) as a target endpoint):\r\n\r\nShowing headers:\r\n```\r\nmsf-git (S:0 J:0)> http_request -I https://api.github.com/users/octocat/orgs\r\nHTTP/1.1 200 OK\r\nServer: GitHub.com\r\nDate: Fri, 13 Mar 2015 01:10:03 GMT\r\nContent-Type: application/json; charset=utf-8\r\nContent-Length: 2\r\nStatus: 200 OK\r\nX-RateLimit-Limit: 60\r\nX-RateLimit-Remaining: 55\r\nX-RateLimit-Reset: 1426209515\r\nCache-Control: public, max-age=60, s-maxage=60\r\nETag: \"d751713988987e9331980363e24189ce\"\r\nVary: Accept, Accept-Encoding\r\nX-GitHub-Media-Type: github.v3; format=json\r\nX-XSS-Protection: 1; mode=block\r\nX-Frame-Options: deny\r\nContent-Security-Policy: default-src 'none'\r\nAccess-Control-Allow-Credentials: true\r\nAccess-Control-Expose-Headers: ETag, Link, X-GitHub-OTP, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset, X-OAuth-Scopes, X-Accepted-OAuth-Scopes, X-Poll-Interval\r\nAccess-Control-Allow-Origin: *\r\nX-GitHub-Request-Id: 4CBC45A9:56A1:114821:550238EB\r\nStrict-Transport-Security: max-age=31536000; includeSubdomains; preload\r\nX-Content-Type-Options: nosniff\r\nX-Served-By: 8a5c38021a5cd7cef7b8f49a296fee40\r\n\r\nmsf-git (S:0 J:0)>\r\n```\r\n\r\nSubmitting credentials via basic authentication:\r\n```\r\nmsf-git (S:0 J:0)> http_request https://api.github.com -u foo:bar\r\n{\"message\":\"Bad credentials\",\"documentation_url\":\"https://developer.github.com/v3\"}\r\nmsf-git (S:0 J:0)>\r\n```\r\n\r\nConnecting with specific SSL versions:\r\n```\r\nmsf-git (S:0 J:0)> http_request -2 https://api.github.com/\r\n[-] Encountered an SSL error\r\nmsf-git (S:0 J:0)> http_request -3 https://api.github.com/\r\n[-] Encountered an SSL error\r\nmsf-git (S:0 J:0)> http_request -1 https://api.github.com/\r\n{\"current_user_url\":\"https://api.github.com/user\",\"current_user_authorizations_html_url\":\"https://github.com/settings/connections/applications{/client_id}\",\"authorizations_url\":\"https://api.github.com/authorizations\",\"code_search_url\":\"https://api.github.com/search/code?q={query}{&page,per_page,sort,order}\",\"emails_url\":\"https://api.github.com/user/emails\",\"emojis_url\":\"https://api.github.com/emojis\",\"events_url\":\"https://api.github.com/events\",\"feeds_url\":\"https://api.github.com/feeds\",\"following_url\":\"https://api.github.com/user/following{/target}\",\"gists_url\":\"https://api.github.com/gists{/gist_id}\",\"hub_url\":\"https://api.github.com/hub\",\"issue_search_url\":\"https://api.github.com/search/issues?q={query}{&page,per_page,sort,order}\",\"issues_url\":\"https://api.github.com/issues\",\"keys_url\":\"https://api.github.com/user/keys\",\"notifications_url\":\"https://api.github.com/notifications\",\"organization_repositories_url\":\"https://api.github.com/orgs/{org}/repos{?type,page,per_page,sort}\",\"organization_url\":\"https://api.github.com/orgs/{org}\",\"public_gists_url\":\"https://api.github.com/gists/public\",\"rate_limit_url\":\"https://api.github.com/rate_limit\",\"repository_url\":\"https://api.github.com/repos/{owner}/{repo}\",\"repository_search_url\":\"https://api.github.com/search/repositories?q={query}{&page,per_page,sort,order}\",\"current_user_repositories_url\":\"https://api.github.com/user/repos{?type,page,per_page,sort}\",\"starred_url\":\"https://api.github.com/user/starred{/owner}{/repo}\",\"starred_gists_url\":\"https://api.github.com/gists/starred\",\"team_url\":\"https://api.github.com/teams\",\"user_url\":\"https://api.github.com/users/{user}\",\"user_organizations_url\":\"https://api.github.com/user/orgs\",\"user_repositories_url\":\"https://api.github.com/users/{user}/repos{?type,page,per_page,sort}\",\"user_search_url\":\"https://api.github.com/search/users?q={query}{&page,per_page,sort,order}\"}\r\nmsf-git (S:0 J:0)>\r\n```\r\n\r\nCheck and save the egress IP address via Dyn-DNS to a file with -o\r\n```\r\nmsf-git (S:1 J:0) exploit(handler) > http_request \"http://checkip.dyndns.com/\" -o my_ip.txt\r\n[*] Wrote 106 bytes to /home/steiner/repos/msf-git/my_ip.txt\r\nmsf-git (S:1 J:0) exploit(handler) > cat my_ip.txt\r\n[*] exec: cat my_ip.txt\r\n\r\n<html><head><title>Current IP Check</title></head><body>Current IP Address: xx.xx.xx.xx</body></html>\r\nmsf-git (S:1 J:0) exploit(handler) >\r\n```\r\n\r\nTo do:\r\n - [ ] Load the requests plugin\r\n - [ ] View the help output to show option flags\r\n - [ ] Pick an HTTP end point and make a GET request to it with parameters\r\n - [ ] Make a POST request to it with parameters in -d\r\n - [ ] Try different methods (OPTIONS and FAKE are fun)\r\n"},"comment":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/comments/86325025","html_url":"https://github.com/rapid7/metasploit-framework/pull/4926#issuecomment-86325025","issue_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/4926","id":86325025,"user":{"login":"kernelsmith","id":620129,"avatar_url":"https://avatars.githubusercontent.com/u/620129?v=3","gravatar_id":"","url":"https://api.github.com/users/kernelsmith","html_url":"https://github.com/kernelsmith","followers_url":"https://api.github.com/users/kernelsmith/followers","following_url":"https://api.github.com/users/kernelsmith/following{/other_user}","gists_url":"https://api.github.com/users/kernelsmith/gists{/gist_id}","starred_url":"https://api.github.com/users/kernelsmith/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kernelsmith/subscriptions","organizations_url":"https://api.github.com/users/kernelsmith/orgs","repos_url":"https://api.github.com/users/kernelsmith/repos","events_url":"https://api.github.com/users/kernelsmith/events{/privacy}","received_events_url":"https://api.github.com/users/kernelsmith/received_events","type":"User","site_admin":false},"created_at":"2015-03-26T03:34:18Z","updated_at":"2015-03-26T03:34:18Z","body":"cool, will do\n"}}