Question: Am I doing something wrong? /Vhost scanning

[bug-bounty-001]

Description:
I tried to fuzz host header and send it to same IP address.
I ran 2 different commands to demonstrate, I didn't get expected behaviour from second one. Only difference is http/https.

First one: (this works as expected)
ffuf -w subdomains-top1million-20000.txt -u https://142.250.187.142 -H "HOST: FUZZ.google.com" -H "Custom: just testing my tools" -x http://localhost:8080 -t 1 -rate 1

Screenshots from Burp Suite 1:

Second one:
ffuf -w subdomains-top1million-20000.txt -u http://142.250.187.142 -H "HOST: FUZZ.google.com" -H "Custom: just testing my tools" -x http://localhost:8080 -t 1 -rate 1

Screenshots from Burp Suite 2:

Problem:
Apparently I can't change host header in http request.

I am probably missing some configuration or flag, can you assist me?
Thank you.

[bsysop]

Hi @bug-bounty-001,
Nice catch, this indeed looks like an issue, but it could be an issue in Burp or the proxying from Ffuf.

Note: Fuzzing with your same arguments (have changed the WL and proxy port)

Checking Burp, this is sending requests to different IPs

But when fuzzing to the HTTPs, the IPs are the same as the target.

This will need a deeper analysis, I hope it doesn't affect your tests.

[bug-bounty-001]

Hi @bsysop,
Thank you for quick response.
I checked it with wireshark (maybe I should have done that before :D) it looks fine, as you said issue probably related to proxy or Burp.
ffuf -w subdomains-top1million-20000.txt -u https://142.250.187.142 -H "HOST: FUZZ.google.com" -t 1 -rate 1

ffuf -w subdomains-top1million-20000.txt -u http://142.250.187.142 -H "HOST: FUZZ.google.com" -t 1 -rate 1

ffuf -w subdomains-top1million-20000.txt -u http://142.250.187.142:4444 -H "HOST: FUZZ.google.com" -t 1 -rate 1

//It doesn't affect my tests, I was planning to use it on ctf. Thank you for contributing to this great tool.

[bsysop]

Lol, nice work!

[joohoi]

This is actually a feature from HTTP spec, I have stumbled into this before and I figured out it was stemming from the Go standard library request.go, around line 600 in current version.

However upon double checking the related RFCs it was pretty clearly written there.

When a proxy receives a request with an absolute-form of
request-target, the proxy MUST ignore the received Host header field
(if any) and instead replace it with the host information of the
request-target. A proxy that forwards such a request MUST generate a
new Host field-value based on the received request-target rather than
forward the received Host field-value.

Now while I might end up working around this in the future, I probably won't, as it's a lot of work for a single niche use case - fuzzing Host - header while using a HTTP proxy.