HackTricks
Searchโ€ฆ
๐Ÿ‘ฝ
Network Services Pentesting
Golang
Support HackTricks and get benefits!

CONNECT method

In golang, the library net/http usually transforms the path to a canonical one before accessing it:
  • /flag/ -- Is responded with a redirect to /flag
  • /../flag --- Is responded with a redirect to /flag
  • /flag/. -- Is responded with a redirect to /flag
However, when the CONNECT method is used this doesn't happen. So, if you need to access some protected resource you can abuse this trick:
curl --path-as-is -X CONNECT http://gofs.web.jctf.pro/../flag
Support HackTricks and get benefits!
Last modified 3mo ago
Copy link