rapid7/metasploit-framework — pull request #863 by ethicalhack3r (2012-10-05 21:05:31+00:00)
Title: Added header support to php_include module

Hi,

This is my first pull request so if I have done anything wrong please let me know so that I can avoid doing so next time.

The following changes will allow users to set HTTP headers. This will allow users to exploit vulnerabilities that require authentication by sending authenticated session cookies.

Usage:
set HEADERS "Cookie: security=low; PHPSESSID=vu8ljn4smpaj5j6p99cqqnbn85"

I've tested it against DVWA's file inclusion vulnerability, both using GET and POST requests and it worked.

Thanks,
Ryan