"""
    Host Header Spoofing for SSRF Detection

    This script demonstrates the ability to spoof the Host header in HTTP requests.
    The purpose is to detect out-of-band interactions and Server-Side Request Forgery (SSRF) vulnerabilities.

    The Host header is set to a payload generated by Burp Suite's Collaborator tool.
    This payload is a unique domain name that Burp Suite listens for DNS lookups and HTTP requests on.

    It showcases the capability to use Burp Suite's API object in Python seamlessly, via Java Embedded Python (JEP),
    which allows Python scripts to interact with Java objects as if they were Python objects.
"""

from pyscalpel import Request, ctx

# Directly access the Montoya API Java object to generate a payload
PAYLOAD = str(ctx["API"].collaborator().defaultPayloadGenerator().generatePayload())


def request(req: Request) -> Request | None:
    """
    Modifies the Host header in the HTTP request to the generated payload.

    Args:
        req: The incoming HTTP request.

    Returns:
        The modified HTTP request with the spoofed Host header.
    """
    req.host_header = PAYLOAD
    return req
