Proxy-attack simulation

Question

I have a WS2008 x64 server, that has NodeJS application working on its 80 port. Server constantly receives queries from different IP-addresses that are trying to use my application as a proxy. NodeJS (working with Express module) is replying with 404 error, but fails during session initialization (using Everyauth module).

So, I've splitted the problem in two parts:

I need to find the way how to simulate requests from attackers;
Find out why these requests are processed in a wrong way (this one I will ask at another forum)

Here is a typical request from attacker:

GET http://www.baidu.com/ HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://www.baidu.com/
Host: www.baidu.com
Accept-Encoding: gzip, deflate
Proxy-Connection: Keep-Alive

I've tried to recreate it with cURL (replacing www.baidu.com with IP-address of my server in hosts)

curl -H "Host: www.baidu.com" -H "Referer: http://www.baidu.com" -H "Accept-Encoding: gzip, deflate" -H "Proxy-Connection: keep-alive" -H "User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)" -H "Content-Type: application/x-www-form-urlencoded" -v -X GET http://www.baidu.com/

, but it is processed as

GET / HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://www.baidu.com
Host: www.baidu.com
Accept-Encoding: gzip, deflate
Proxy-Connection: Keep-Alive

So, my question is - how do I put http://www.baidu.com instead of / (SLASH) in GET request?

how about using telnet instead using curl? – masegaloeh Dec 15 '14 at 05:47 — masegaloeh, Dec 15 '14 at 05:47

score 1 · Accepted Answer · answered Dec 15 '14 at 05:54

So, my question is - how do I put http://www.baidu.com instead of / (SLASH) in GET request?

The request you want to have is not a bad one, but just a proxy request. To create it just specify your target host as a proxy. Apart from that curl might be not the right tool to generate real bad requests.

Proxy-attack simulation

1 Answers1