GitBook: [master] 2 pages modified

Author: carlospolop

SUMMARY.md

@@ -181,6 +181,7 @@
 * [69/UDP TFTP/Bittorrent-tracker](pentesting/69-udp-tftp.md)
 * [79 - Pentesting Finger](pentesting/pentesting-finger.md)
 * [80,443 - Pentesting Web Methodology](pentesting/pentesting-web/README.md)
+  * [Golang](pentesting/pentesting-web/golang.md)
   * [Uncovering CloudFlare](pentesting/pentesting-web/uncovering-cloudflare.md)
   * [Laravel](pentesting/pentesting-web/laravel.md)
   * [Code Review Tools](pentesting/pentesting-web/code-review-tools.md)

pentesting/pentesting-web/golang.md

@@ -0,0 +1,18 @@
+# Golang
+
+### CONNECT method
+
+In golang, the library net/http usually transforms the path to a canonical one before accessing it:
+
+* /flag/ -- Is responded with a redirect to /flag
+* /../flag --- Is responded with a redirect to /flag
+* /flag/. -- Is responded with a redirect to /flag
+
+However, when the CONNECT method is used this doesn't happen. So, if you need to access some protected resource you can abuse this trick: 
+
+```text
+curl --path-as-is -X CONNECT http://gofs.web.jctf.pro/../flag
+```
+
+[https://github.com/golang/go/blob/9bb97ea047890e900dae04202a231685492c4b18/src/net/http/server.go\#L2354-L2364](https://github.com/golang/go/blob/9bb97ea047890e900dae04202a231685492c4b18/src/net/http/server.go#L2354-L2364)
+