Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Change Content-Type suggestion #82

Merged

Conversation

adamhurm
Copy link
Contributor

@adamhurm adamhurm commented Oct 4, 2022

Using {'Content-Type': 'application/json'} will result in "400 Bad Request: invalid header name" response.

Additionally, I noticed there was some confusion like this issue: #81 and this discord post. In both scenarios a user submitted a screenshot where the Custom Header field is empty. It was not an issue with Kubernetes Goat, but maybe we can clear up the confusion by auto-filling fields or adding additional instructions to the scenario hints.


I see that you're using HACKTOBERFEST-ACCEPTED label so feel free to do that to this PR too.

avoid confusion like this: madhuakula#81

Using `{'Content-Type': 'application/json'}` will result in "400 Bad Request: invalid header name" response
@adamhurm adamhurm force-pushed the change-ssrf-scenario-suggestion branch from 8dc681b to e4367f9 Compare October 4, 2022 23:36
@mrintern
Copy link

mrintern commented Oct 5, 2022

Honestly the main confusion is when one does exactly what is in the kubernetes goat walkthrough, the flag is not received. The walkthrough must be the source of truth.

I'm referencing this image from the walkthrough. It seems the "Custom Header" section is blank yet the flag is recieved

image

@madhuakula
Copy link
Owner

Yes @mrintern definitely you are right 👍 . But if you use this and deploy in GCP GKE, may be for metadata you need custom headers like "Metadata-Flavor: Google" and also there are lot more attack surface is there. So I will just add this fix :)

Thanks again @adamhurm as always you are awesome 🙏

@madhuakula madhuakula merged commit 818e229 into madhuakula:master Oct 6, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants