Function TestRequestFilePreservesQueryString

cmd/bypass_test.go:626–679

(t *testing.T)

}

func TestRequestFilePreservesQueryString(t *testing.T) {
	resetTestState()

	// Create a mock server that records the full request URI
	var mu sync.Mutex
	var capturedURIs []string

	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		mu.Lock()
		capturedURIs = append(capturedURIs, r.URL.RequestURI())
		mu.Unlock()
		w.WriteHeader(http.StatusForbidden)
		fmt.Fprint(w, "Forbidden")
	}))
	defer ts.Close()

	// Build a raw HTTP request with query parameters (Burp-style)
	rawRequest := fmt.Sprintf("GET /upload?action=get_config_data&user_id=239501342 HTTP/1.1\r\nHost: %s\r\n\r\n",
		strings.TrimPrefix(ts.URL, "http://"))

	dir := t.TempDir()
	reqFile := filepath.Join(dir, "request.txt")
	if err := os.WriteFile(reqFile, []byte(rawRequest), 0o600); err != nil {
		t.Fatalf("write request file: %v", err)
	}

	payloadsDir := setupPayloadsDir(t)

	// Override package-level vars for the test
	folder = payloadsDir
	nobanner = true
	technique = []string{"verbs"}

	loadFlagsFromRequestFile(reqFile, true, true, []string{"verbs"}, false)

	mu.Lock()
	defer mu.Unlock()

	if len(capturedURIs) == 0 {
		t.Fatal("expected requests to be sent from request file, got 0")
	}

	// The first request (default) should contain the full query string
	foundQueryString := false
	for _, uri := range capturedURIs {
		if strings.Contains(uri, "action=get_config_data") && strings.Contains(uri, "user_id=239501342") {
			foundQueryString = true
			break
		}
	}
	if !foundQueryString {
		t.Errorf("query string was stripped from request file URL. Captured URIs: %v", capturedURIs)
	}
}

func TestRequestFileParsesPostWithBody(t *testing.T) {
	resetTestState()