[vaiperboy]

https://stackoverflow.com/questions/5583...to-headers

I'm the creator of that request and seeking support here
Please suggest me stuff to do as I'm out of ideas, also newbies don't suggest stuff.

Spoiler (Click to View)
I just got into .net core due to the features it has to offer for HttpClient (example is setting the keep-alive header capped down). I'm using 2.1 net core and C# 7.3

My issue

My issue is specifically about setting the "Accept" and "Accept-Language" headers. The site I'm trying to reach parses these two headers as is, meaning it must have the same exact format (including spaces).

Using fiddler (and some other tools) to grab my request.

1. I'm capturing the "Accept" header as the following: (incorrect format)
   text/html, application/xhtml+xml, application/xml; q=0.9, image/webp, image/apng, */*; q=0.8, application/signed-exchange; v=b3


2. instead of: (correct format)
   
   text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3


3. "Accept-Language" header as the following: (incorrect format)
   en-US, en; q=0.9, ar; q=0.8, und; q=0.7


4. Instead of: (correct format)
   en-US,en;q=0.9,ar;q=0.8,und;q=0.7

I'm simulating a GET request using HttpClient with the help of HttpRequestMessage.


What I have tried

1. Tried both settings my headers in the HttpClient instance and firing off a HttpRequestMessage with it's own headers, none are working.
   


2. Tried lots of solutions online which didn't work, including this
   


3. Splitting the header through multiple .Headers.TryAddWithoutValidation
   


4. Tried HttpWebRequests as well. No luck. One thing to note, due to my project I also like to stick with the HttpClient.
   

You'll find below my current code

Code

var client = new HttpClient(new HttpClientHandler() { UseCookies = false,
           AllowAutoRedirect = false,
           Proxy = new WebProxy("localhost:8888") });

var httpReq = new HttpRequestMessage(HttpMethod.Get, $"myurl");


           httpReq.Headers.TryAddWithoutValidation("Host", "myurl");
           httpReq.Headers.TryAddWithoutValidation("Connection", "keep-alive");
           httpReq.Headers.TryAddWithoutValidation("Cookie", $"cookie");
           httpReq.Headers.TryAddWithoutValidation("Upgrade-Insecure-Requests", "1");
           httpReq.Headers.TryAddWithoutValidation("User-Agent", Data.user_agent);
           httpReq.Headers.TryAddWithoutValidation("Accept-Encoding", "gzip, deflate, br");
           httpReq.Headers.TryAddWithoutValidation("Accept", "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3");
           httpReq.Headers.TryAddWithoutValidation("Referer", Data.homeUrl);
           httpReq.Headers.TryAddWithoutValidation("Accept-Language", "en-US,en;q=0.9,ar;q=0.8,und;q=0.7");

           req = await client.SendAsync(httpReq);

As noted before, all the other headers are working fine. Just these two Accept and Accept-Language are being inputted differently.

[ＪＵＳＴＩＮ]

Take a look at section 14 of RFC2616, aka IETF's official documentation for HTTP.
https://www.w3.org/Protocols/rfc2616/rfc...html#sec14

The format that is actually being sent isn't wrong. Spacing shouldn't matter. In reality this is a problem with the site owner.
Regardless, I just tested Accept/Accept-Language headers via the WebClient class and they weren't modified before being sent.
If it's really a big problem you can try implementing that instead.

Since somebody on the Stackoverflow thread pointed out that this is hardcoded in CoreFX (https://github.com/dotnet/corefx/blob/a1...ue.cs#L183) you could also override the ToString method in the NameValueHeaderValue class.

[Meterpreter]

I would personally recommend using WebClient.

For HttpClient and similar often make it difficult to set Host, Accept, and Content headers. WebClient is much easier. Also Justin is correct, spacing really shouldnt matter, the semi colons specific the break anyway not the space.

Webclient is literally 100 times easier:
Weblient wc = new WebClient();
wc.Headers[HttpRequestHeaders.Host] = "test";
wc.Headers[HttpRequestHeaders.Accept] = "";
And if you want to use a custom header its undoubtedly the easiest to use to do so:
wc.Headers["Custom-Header"] = "custom value";