Error running httpx with '%' character in path

[shelld3v]

Example

Working: httpx -l list -path /hell
Quitting: httpx -l list -path /%hell

This issue is similar to a bug I found in gobuster

[ehsandeep]

@shelld3v httpx -l list -path "/%hell" is expected input.

[shelld3v]

@shelld3v httpx -l list -path "/%hell" is expected input.

I tried it too

[Mzack9999]

@shelld3v go standard library doesn't allow unescaped non-ASCII characters in the request URI path. Therefore you need to use the -unsafe flag. For the same reason, another internal library was unable to parse this kind of URL correctly. This should be fixed in #340

[ehsandeep]

@shelld3v Now non-ascii characters are supported with unsafe flag.

echo hackerone.com | ./httpx -path "/%hell" -unsafe -silent
https://hackerone.com/%hell

[shelld3v]

@ehsandeep Hi I think I still have some problems with this. I tried httpx -unsafe -l list.txt with list.txt contains:

http://example.com/%u

And it didn't work:(

[ehsandeep]

@shelld3v We still have to create a new release for these changes, check this PR - #370

It will work only if you build httpx from the dev version or wait for the new release.

[shelld3v]

@ehsandeep Thanks for your response, I don't know why with httpx v1.1.1 I was able to do httpx -unsafe -path '/%invalid' -l list.txt (my original problem) but not echo 'http://example.com/%invalid' | httpx -unsafe 🤔

[ehsandeep]

@shelld3v can confirm, it works as expected with paths but not with direct input.

[ehsandeep]

@shelld3v should be fixed in the latest release.

[shelld3v]

Hi I believe I'm facing the same issue with nuclei, can you re-check?

[ehsandeep]

@shelld3v please open a new issue on Nuclei project with an example template, that will help to track the issue along with fix.