Learn about request tampering in HTTP with Nuclei
@Host:
which overrides the real target of the request (usually the host/ip provided as input). It supports syntax with ip/domain, port, and scheme, for example: domain.tld
, domain.tld:port
, http://domain.tld:port
@tls-sni:
which overrides the SNI Name of the TLS request (usually the hostname provided as input). It supports any literals. The special value request.host
uses the Host
header and interactsh-url
uses an interactsh generated URL.@timeout:
which overrides the timeout for the request to a custom duration. It supports durations formatted as string. If no duration is specified, the default Timeout flag value is used.timeout
annotations -
sni
annotation with interactsh-url
-
unsafe: true
attribute for rawhttp based requests.