dial tcp "no such host" error on a specific case

[aroly]

Hello,

I'm currently facing a weird issue with one specific case when using the lib to send "malformed" HTTP request. My idea is to send a request to a specific HTTP(S) server, but with a different "Host" header in the HTTP request, to test for Host header attacks. Most of the time, this works well, but I sometimes receive this issue when running the code.

go run test.go

Target server: https://foo.com
Hostname: bar.com
Error while requesting https://foo.com with bar.com
2021/10/15 11:03:52 Error: dial tcp: lookup bar.com on 192.168.1.1:53: no such host
exit status 1

In this case, the hostname I want to use is not known by the DNS, but this should not be a problem. And it woks perfectly in other cases. I attached the code I use as txt (it's crappy, but it's the first time I write something in Go :)).

test.go.txt

[Mzack9999]

@aroly Thanks for opening this issue. The scenario that you are describing can be done also with the standard library as you can see at the following link.
From the error code it seems like that your host, for some reason, wasn't able to resolve the ip address for the target host (foo.com). You can check the request being sent with any web server, for example https://github.com/projectdiscovery/simplehttpserver. In my case for the following snippet:

package main

import (
	"fmt"
	"log"
	"net/http"

	"github.com/projectdiscovery/rawhttp"
)

func main() {
	webserver := "http://localhost:8000"
	hostname := "bar.com"
	fmt.Println("Target server: " + webserver)
	fmt.Println("Hostname: " + hostname)
	clientOptions := rawhttp.DefaultOptions
	clientOptions.AutomaticHostHeader = false
	clientOptions.FollowRedirects = false
	client := rawhttp.NewClient(clientOptions)
	req, err := http.NewRequest("GET", webserver, nil)
	req.Method = "GET"
	req.Header.Set("Host", " "+hostname)
	req.Host = hostname
	req.Header.Set("User-Agent", " Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36")
	req.Header.Set("Connection", " close")
	req.Header.Set("Accept", " */*")
	req.Proto = "HTTP/1.1"

	//fmt.Printf("%+v\n\n", req)
	resp, err := client.Do(req)

	if err != nil {
		fmt.Printf("Error while requesting %s with %s\n", webserver, hostname)
		log.Fatalf("Error: %s", err)
	}

	fmt.Printf("Status: %s, Content-Length: %d\n", resp.Status, int64(resp.ContentLength))
	fmt.Printf("\n%s / HTTP/1.1\n", req.Method)
	for name, values := range req.Header {
		// Loop over all values for the name.
		for _, value := range values {
			fmt.Printf("%s:%s\n", name, value)
		}
	}
}

I get this output (where you can see the host header being set correctly):

$ simplehttpserver -verbose
Remote Address: [::1]:50504
GET / HTTP/1.1
Host: bar.com
Connection: close
Accept: */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36


HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
Last-Modified: Sat, 28 Aug 2021 22:49:10 GMT

[aroly]

Hello,

Thanks for pointing out that I can do what I want using the standard library.

For the record, I finally found out why I was getting an error in some specific cases, I'm gonna explain it here in case someone else has the same issue.

My idea was to send a HTTP request to, let's say, https://example.com with a different Host HTTP header, for example internal.example.com. An important thing here is that internal.example.com is not known by the public DNS, it's supposed to be accessible only from example.com internal network.

Most of the time, even with HTTP Host header unknown by the DNS (for example nonexistent.example.com), it was working correctly, I was receiving the webserver's response normally, whatever this response was (400 Bad Request, or whatever). But from time to time, I was receiving an error Error: dial tcp: lookup internal.example.com on 192.168.1.1:53: no such host.

My issue came from the fact that the webserver was sending back a HTTP 302 to https://internal.example.com/app, and the HTTP client was trying to follow this redirect. Since this hostname internal.example.com is not known by the public DNS, it failed with the error above Error: dial tcp: lookup internal.example.com on 192.168.1.1:53: no such host.

To avoid this case, I used the trick I found here: https://stackoverflow.com/questions/23297520/how-can-i-make-the-go-http-client-not-follow-redirects-automatically

client := &http.Client{
    CheckRedirect: func(req *http.Request, via []*http.Request) error {
        return http.ErrUseLastResponse
    },
}