diff --git a/docs/metasploit-framework.wiki/How-to-Send-an-HTTP-Request-Using-HttpClient.md b/docs/metasploit-framework.wiki/How-to-Send-an-HTTP-Request-Using-HttpClient.md index 99fdea52b4..d835900e07 100644 --- a/docs/metasploit-framework.wiki/How-to-Send-an-HTTP-Request-Using-HttpClient.md +++ b/docs/metasploit-framework.wiki/How-to-Send-an-HTTP-Request-Using-HttpClient.md @@ -81,14 +81,17 @@ Any object passed to `cookie` that isn't an instance of HttpCookieJar will have ---- -Module authors can also pass an instance of `HttpCookieJar` with the `cookie` option: +Module authors can also pass an instance of `HttpCookieJar` with the `cookie` option. + +Important: Cookies added to a `HttpCookieJar` must have both `domain` and `path` set, and cookie values must be strings. Without these attributes the underlying cookie store will raise an `ArgumentError`. ```ruby cj = Msf::Exploit::Remote::HTTP::HttpCookieJar.new -cj.add(Msf::Exploit::Remote::HTTP::HttpCookie.new('PHPSESSID', @phpsessid)) -cj.add(Msf::Exploit::Remote::HTTP::HttpCookie.new('AsWebStatisticsCooKie', 1)) -cj.add(Msf::Exploit::Remote::HTTP::HttpCookie.new('shellinaboxCooKie', 1)) +target_host = datastore['RHOST'] +cj.add(Msf::Exploit::Remote::HTTP::HttpCookie.new('PHPSESSID', @phpsessid, domain: target_host, path: '/')) +cj.add(Msf::Exploit::Remote::HTTP::HttpCookie.new('AsWebStatisticsCooKie', '1', domain: target_host, path: '/')) +cj.add(Msf::Exploit::Remote::HTTP::HttpCookie.new('shellinaboxCooKie', '1', domain: target_host, path: '/')) res = send_request_cgi({ 'method' => 'GET', diff --git a/spec/lib/msf/core/exploit/remote/remote/http/http_cookie_spec.rb b/spec/lib/msf/core/exploit/remote/remote/http/http_cookie_spec.rb index 0fe2aeb644..747502023b 100644 --- a/spec/lib/msf/core/exploit/remote/remote/http/http_cookie_spec.rb +++ b/spec/lib/msf/core/exploit/remote/remote/http/http_cookie_spec.rb @@ -68,7 +68,14 @@ RSpec.describe Msf::Exploit::Remote::HTTP::HttpCookie do expect(cookie.value.class).to eql(String) end end - + + describe 'Integer' do + it 'passed as value during initialization is converted to a String' do + c = described_class.new('test_cookie', 1) + expect(c.value).to eql('1') + expect(c.value.class).to eql(String) + end + end describe 'nil' do it 'assigned to value results in it being set to an empty string and expires is set UNIX_EPOCH' do v = nil