Full httpscan

[MindPatch]

To scan full requests under the SCAN_ID number 0 in Lotus, users can employ a single function to inject the payload. By utilizing CLI options, they can specify the specific portion of the request they wish to scan.

[MindPatch]

now we support JSON/urlencode/headers auto injection

DEMO

[
  {
    "method": "POST",
    "url": "http://google.com/",
    "headers": {
      "X-API": "fff"
    },
    "body": "{\"userid\":[1,\"hhh\"],\"kkk\":{\"hahaha\":\"gosfkoasfk\"},\"admin\":\"true\"}"
  }
]

SCAN_TYPE = 0


function tester(data)
    for k,v in pairs(data) do
        full_req:send(v,http)
    end
end

function main()
    http:merge_headers(true)
    local data = full_req:set_json_param("nothing",false)
    tester(data)
    local data = full_req:set_body_param("nothing",false)
    tester(data)
end

$ cat req.json  | lotus scan test.lua -v