Fix field values

hupe1980 · hupe1980 · commit d50b0284301f · 2021-12-25T22:18:06.000+01:00
diff --git a/README.md b/README.md
@@ -207,7 +207,9 @@ Flags:
       --proxy string                proxy url
   -r, --resource string             resource in payload (default "l4s")
       --schema string               schema to use for requests (default "https")
-      --set-header stringToString   set fix header value (default [])
+      --set-field stringToString    set fix field value (key=value) (default [])
+      --set-header stringToString   set fix header value (key=value) (default [])
+      --set-param stringToString    set fix query param value (key=value) (default [])
       --submit-forms                add form submits to fuzzing
       --timeout duration            time limit for requests (default 3s)
   -t, --type strings                get, post or json (default [get])
@@ -255,7 +257,9 @@ Flags:
       --payloads-file string        use custom payloads from file
       --proxy string                proxy url
   -r, --resource string             resource in payload (default "l4s")
-      --set-header stringToString   set fix header value (default [])
+      --set-field stringToString    set fix field value (key=value) (default [])
+      --set-header stringToString   set fix header value (key=value) (default [])
+      --set-param stringToString    set fix query param value (key=value) (default [])
       --submit-forms                add form submits to fuzzing
       --timeout duration            time limit for requests (default 3s)
   -t, --type strings                get, post or json (default [get])
diff --git a/cmd/remote.go b/cmd/remote.go
@@ -38,8 +38,10 @@ type remoteOptions struct {
 	headerValues       map[string]string
 	fieldsFile         string
 	fields             []string
+	fieldValues        map[string]string
 	paramsFile         string
 	params             []string
+	paramValues        map[string]string
 	payloadsFile       string
 	payloads           []string
 	maxThreads         int
@@ -87,7 +89,9 @@ func addRemoteFlags(cmd *cobra.Command, opts *remoteOptions) {
 	cmd.Flags().StringSliceVarP(&opts.fields, "field", "", nil, "field to use")
 	cmd.Flags().StringSliceVarP(&opts.params, "param", "", nil, "query param to use")
 	cmd.Flags().StringSliceVarP(&opts.payloads, "payload", "", nil, "payload to use")
-	cmd.Flags().StringToStringVarP(&opts.headerValues, "set-header", "", nil, "set fix header value")
+	cmd.Flags().StringToStringVarP(&opts.headerValues, "set-header", "", nil, "set fix header value (key=value)")
+	cmd.Flags().StringToStringVarP(&opts.fieldValues, "set-field", "", nil, "set fix field value (key=value)")
+	cmd.Flags().StringToStringVarP(&opts.paramValues, "set-param", "", nil, "set fix query param value (key=value)")
 }
 
 var unauthorizedHandler = func(verbose bool) internal.StatusCodeHandlerFunc {
diff --git a/cmd/remote_cidr.go b/cmd/remote_cidr.go
@@ -75,8 +75,12 @@ func newRemoteCIDRCmd(noColor *bool, output *string, verbose *bool) *cobra.Comma
 				HeaderValues:       opts.headerValues,
 				FieldsFile:         opts.fieldsFile,
 				Fields:             opts.fields,
+				FieldValues:        opts.fieldValues,
 				PayLoadsFile:       opts.payloadsFile,
 				Payloads:           opts.payloads,
+				ParamsFile:         opts.paramsFile,
+				Params:             opts.params,
+				ParamValues:        opts.paramValues,
 				Timeout:            opts.timeout,
 				CheckCVE2021_45046: opts.checkCVE2021_45046,
 			}
diff --git a/cmd/remote_url.go b/cmd/remote_url.go
@@ -73,8 +73,12 @@ func newRemoteURLCmd(noColor *bool, output *string, verbose *bool) *cobra.Comman
 				HeaderValues:       opts.headerValues,
 				FieldsFile:         opts.fieldsFile,
 				Fields:             opts.fields,
+				FieldValues:        opts.fieldValues,
 				PayLoadsFile:       opts.payloadsFile,
 				Payloads:           opts.payloads,
+				ParamsFile:         opts.paramsFile,
+				Params:             opts.params,
+				ParamValues:        opts.paramValues,
 				Timeout:            opts.timeout,
 				CheckCVE2021_45046: opts.checkCVE2021_45046,
 			}
diff --git a/internal/remote.go b/internal/remote.go
@@ -39,10 +39,12 @@ type RemoteOptions struct {
 	HeaderValues       map[string]string
 	FieldsFile         string
 	Fields             []string
+	FieldValues        map[string]string
 	PayLoadsFile       string
 	Payloads           []string
 	ParamsFile         string
 	Params             []string
+	ParamValues        map[string]string
 	Timeout            time.Duration
 	CheckCVE2021_45046 bool
 }
@@ -170,6 +172,10 @@ func (rs *RemoteScanner) newRequest(ctx context.Context, method, u, payload stri
 			data.Set(field, payload)
 		}
 
+		for k, v := range rs.opts.FieldValues {
+			data.Set(k, v)
+		}
+
 		req, err = http.NewRequestWithContext(ctx, "POST", u, strings.NewReader(data.Encode()))
 		if err != nil {
 			return nil, err
@@ -182,6 +188,10 @@ func (rs *RemoteScanner) newRequest(ctx context.Context, method, u, payload stri
 			values[field] = payload
 		}
 
+		for k, v := range rs.opts.FieldValues {
+			values[k] = v
+		}
+
 		jsonValue, err := json.Marshal(values)
 		if err != nil {
 			return nil, err
@@ -206,6 +216,10 @@ func (rs *RemoteScanner) newRequest(ctx context.Context, method, u, payload stri
 		values.Add(q, payload)
 	}
 
+	for k, v := range rs.opts.ParamValues {
+		values.Set(k, v)
+	}
+
 	req.URL.RawQuery = values.Encode()
 
 	return req, nil
