0

So, I am interested, is it possible to send an invalid HTTPS request via command line in Linux, to receive the server's "Error 400" page?
It's possible to generate an invalid HTTP request using "telnet", by telling it to connect to some server on the port 80 and inputting an invalid HTTP request (for example, claiming that you support HTTP/1.1 but provide no Host header).
But is it possible to do the same with HTTPS? As far as I know, you can't do that via "wget" because, well, "wget" is supposed to always produce a syntactically valid HTTP or HTTPS request. You can't do that via "ssh" because the SSH protocol is not HTTPS-like and it will get rejected via the "connection reset" error, rather than "400 Bad Request". So, is there a way to do that?

3
  • Totally beyond my expertise, therefore just a comment: is echo foo | socat - OPENSSL:google.com:443 what you want? Commented Apr 24, 2020 at 12:47
  • @KamilMaciorowski, When I type that in terminal, I get "bash: socat: command not found..." Commented Apr 24, 2020 at 12:49
  • @FlatAssembler Install socat using your Linux distribution's package manager (apt, dnf, yum)
    – GMaster
    Commented Apr 24, 2020 at 13:05

2 Answers 2

2

You can use curl to send HTTP(S) requests.

To remove or having custom headers, the option -H can be used.

To send empty header you can do as below:

curl URL -H 'Host:'

Example:

$ curl https://fedoramagazine.org/ -H 'Host:'

<html>
<head><title>400 Bad Request</title></head>
<body>
<center><h1>400 Bad Request</h1></center>
<hr><center>nginx</center>
</body>
</html>

To get only the response header:

$ curl -s -o /dev/null -D - https://www.imdb.com/ -H 'Host:' 

HTTP/2 400 
server: CloudFront
date: Fri, 24 Apr 2020 15:52:42 GMT
content-type: text/html
content-length: 915
x-cache: Error from cloudfront
2
  • I think this will send an empty "Host" header (syntactically valid HTTP), not a request without a "Host" header. If I try this with GitHub, "curl flatassembler.github.io -H 'Host:'", I get "404 Not Found" instead of "400 Bad Request" (which is, I think, a proper response). Commented Apr 24, 2020 at 13:54
  • No, you can get tcpdump and you will see there is not Host header in the request. The response is based on the webserver configuration.
    – binarysta
    Commented Apr 24, 2020 at 16:15
0

Anyway, I've figured it out by myself. Here is a command to generate an invalid request to github.com (for example):
openssl s_client -servername github.com -connect github.com:443
If you enter a syntactically invalid HTTP request there, you get:

<html>
  <head>
    <meta content="origin" name="referrer">
    <title>Bad request &middot; GitHub</title>
    <meta name="viewport" content="width=device-width">
    <style type="text/css" media="screen">
      body {
        background-color: #f6f8fa;
        color: rgba(0, 0, 0, 0.5);
        font-family: -apple-system,BlinkMacSystemFont,Segoe UI,Helvetica,Arial,sans-serif,Apple Color Emoji,Segoe UI Emoji,Segoe UI Symbol;
        font-size: 14px;
        line-height: 1.5;
      }
      .c { margin: 50px auto; max-width: 600px; text-align: center; padding: 0 24px; }
      a { text-decoration: none; }
      a:hover { text-decoration: underline; }
      h1 { color: #24292e; line-height: 60px; font-size: 48px; font-weight: 300; margin: 0px; }
      p { margin: 20px 0 40px; }
      #s { margin-top: 35px; }
      #s a {
        color: #666666;
        font-weight: 200;
        font-size: 14px;
        margin: 0 10px;
      }
    </style>
  </head>
  <body>
    <div class="c">
      <h1>Whoa there!</h1>
      <p>You have sent an invalid request. <br><br>
        Please do not send this request again.
      </p>
      <div id="s">
        <a href="https://support.github.com">Contact Support</a> &mdash;
        <a href="https://githubstatus.com">GitHub Status</a> &mdash;
        <a href="https://twitter.com/githubstatus">@githubstatus</a>
      </div>
    </div>
  </body>
</html>
2
  • openssl s_client -servername github.com -connect github.com:443 is not an invalid HTTP request. It's trying to create TLS connection with github.com which is corrrect.
    – binarysta
    Commented Apr 24, 2020 at 15:26
  • 1
    @binarysta This is exactly what the OP wanted to achieve: An invalid HTTP request over TLS. Just that your answer is more straight forward. You can also use curl -X with some funny method. Commented Apr 24, 2020 at 16:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .