Customize http repsonse for each id

[stefanovettorazzi]

Hi PD team.

I just had a case where an SSRF makes a request to the host part of a URL rather than the entire URL I pass to it. So, I can't use dynamic responses.
Maybe it could be useful to have a simple SQL lite database that interactsh queries for the id when it's a http(s) request. Probably not by default because maybe not everyone would like to have that delay of the SQL query.
I looked at the code, and I think I could implement it. But I'm unsure if you agree that it makes sense to add it.

Also, I noticed that extensions take precedence over dynamic responses. So, in a case where a client makes a request to /file.json, the dynamic response is ignored. I don't think that's the expected behavior when using dynamic responses.
I could probably make this change, too.

Thanks for the tool.

[ehsandeep]

Hi @stefanovettorazzi

Also, I noticed that extensions take precedence over dynamic responses. So, in a case where a client makes a request to /file.json, the dynamic response is ignored. I don't think that's the expected behavior when using dynamic responses.

This is not expected and can be fixed.

I just had a case where an SSRF makes a request to the host part of a URL rather than the entire URL I pass to it. So, I can't use dynamic responses.

Could you please share more details, preferably with example to better understand the problem?

[stefanovettorazzi]

Thanks for the response, @ehsandeep.

Could you please share more details, preferably with example to better understand the problem?

If I pass a URL like https://github.com/projectdiscovery?parameter=value, the server-side application ends up making a request to https://github.com/some/specific/path.json?parameter=value. If the dynamic response thing is fixed, that one would work. I mentioned "SSRF" because it's a blind SSRF. However, I was trying to figure out how the application behaves when returning the expected response from the service that is supposed to get the response.
After suggesting that idea earlier, I came across another blind SSRF where only host values are accepted. In this case, the expected response is XML, so I wanted to test for XXE issues, but I can't use the dynamic responses feature here because I can't control the query part of the URL.

[stefanovettorazzi]

It just occurred to me that maybe instead of a complex feature, it could just be that interactsh proxies the request to a host of my choosing. For example, I could have a web app that looks for a header like x-interactsh-id in the request and returns a response based on that. So I tell interactsh: "when there is a HTTP request, send it to this host and return the response it returns". Maybe it will be easier to implement and it gives more flexibility?