send_raw_request
Send raw HTTP requests with full control over request line, headers, and body. Use for multipart uploads, unusual headers, or HTTP smuggling tests; requires human approval and blocks private IPs.
Instructions
Send a hand-crafted raw HTTP request (like Burp Repeater's raw editor). No proxy required.
REQUIRES: approved=true (human must approve sending potentially destructive requests).
Use this when you need full control over request formatting — multipart uploads, unusual headers, HTTP smuggling payloads, etc. For replaying captured traffic, use replay_flow instead.
Example raw request: POST /api/login HTTP/1.1 Host: target.com Content-Type: application/json
{"username":"admin","password":"test"}SECURITY: SSRF protection blocks requests to localhost/private IPs.
Args: raw: Complete raw HTTP request text (request line + headers + blank line + body) host: Override the Host header for routing (optional — extracted from Host header if omitted) port: Target port (default: 443 for HTTPS, 80 for HTTP) tls: Use HTTPS (default true). Set false for plain HTTP targets. follow_redirects: Follow HTTP 3xx redirects (default true) approved: MUST be true. Set this ONLY after the human user has explicitly approved this action.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| raw | Yes | ||
| tls | No | ||
| host | No | ||
| port | No | ||
| approved | No | ||
| follow_redirects | No |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |