Requests

GET with query params

The params dictionary represents query-string names and values. requests percent-encodes the required characters and appends the resulting query string to the URL. The injectable value is built before being assigned to the dictionary.

params = {
    "id": 4,
    "q": payload
}
r = s.get(url=URL, params=params, verify=False, proxies=PROXIES, timeout=10)

_{Find by: get, query string, params, url parameters, requests, fetch}

POST form-encoded (data=)

Passing a dictionary through data= serializes its keys and values as an application/x-www-form-urlencoded request body, matching a regular HTML form submission.

login_data = {
    "username": payload,
    "password": "test"
}
r = s.post(url=LOGIN_URL, data=login_data, verify=False, proxies=PROXIES, timeout=10)

_{Find by: post, form, urlencoded, data, login, body, application/x-www-form-urlencoded}

POST JSON body (json=)

Passing a Python dictionary through json= serializes it as JSON and sets Content-Type: application/json. Nested dictionaries remain JSON objects, which is required when an injected operator must reach the application as an object rather than as text.

json_data = {
    "username": "admin",
    "password": {"$ne": None}
}
r = s.post(url=LOGIN_URL, json=json_data, verify=False, proxies=PROXIES, timeout=10)

_{Find by: post, json, application/json, api, body, nosql, operator injection, rest}

POST with Transfer-Encoding: chunked

An iterator has no known total length, so requests omits Content-Length, adds Transfer-Encoding: chunked, and writes the HTTP chunk framing. The body remains raw bytes; Content-Type must be set explicitly when the endpoint expects form data or another specific format.

body = b"username=admin&password=test"
chunked_body = iter([body])
headers = {
    "Content-Type": "application/x-www-form-urlencoded"
}
r = s.post(url=URL, data=chunked_body, headers=headers, verify=False, timeout=10)

The iterator yields one data chunk. requests sends the terminating zero-length chunk after the iterator is exhausted.

Iterator placement

data= must receive an iterator over the complete encoded body instead of the usual dictionary of form fields. The form body is built first, converted to bytes, then wrapped in iter([body]). Passing an iterator as a dictionary value still produces a complete body with Content-Length.

Proxy normalization

An interception proxy can decode the incoming chunks and forward a reconstructed request containing Content-Length, which removes the framing difference being tested. This behavior belongs to the proxy and its configuration rather than to HTTP itself. The forwarded request must be inspected; when the proxy normalizes it, the scripted chunked request is sent directly.

_{Find by: post, requests, transfer-encoding, chunked, chunked request, content-length, iterator, iterator placement, raw body, http request framing, burp, proxy normalization}