Raw Request Bug

[vysecurity]

Nuclei version:

[INF] Current Version: 2.6.9

Current Behavior:

When sending a raw request, a '/' is added.

Expected Behavior:

Raw request to be sent as described in the yaml.

Steps To Reproduce:

1. Run 'nuclei' with the template through Burp.

requests:
- raw:
  - |+
    GET 13333 HTTP/1.1
    Host: {{Hostname}}

  matchers:

        # Status Code
      - type: status
        status:
          - 404

2. Notice that instead of a GET 13333 is sent, actually GET /13333 is sent.

[ehsandeep]

@vysecurity that's standard behavior as per RFC, but nuclei do support optional rawhttp library to make non rfc compliant requests, to use rawhttp library in your template you just need to add unsafe: true and it will work as you expected.

requests:
  - raw:
      - |+
        GET 13333 HTTP/1.1
        Host: {{Hostname}}

    unsafe: true