[protonnegativo]

A Host header passed with -H is only used when the name is spelled exactly Host. Any other casing is silently dropped, so the requests go out with the Host from the URL.

$ gobuster dir -u http://127.0.0.1:19600 -w words -H 'host: target.local'
# server receives Host: 127.0.0.1:19600   (expected target.local)

$ gobuster dir -u http://127.0.0.1:19600 -w words -nch -H 'host: target.local'
# server receives two Host headers: 127.0.0.1:19600 and target.local

NewHTTPClient compares h.Name == "Host", while header names are matched case-insensitively everywhere else (fuzz mode already uses http.CanonicalHeaderKey for this). With --no-canonicalize-headers the lowercase name also goes into req.Header as is, and net/http only filters the canonical Host key, so it is written as an extra header.

This uses http.CanonicalHeaderKey for the check and skips the Host entry when copying the custom headers, since it is already applied through req.Host.

Testing:

• Added TestRequestHostHeader in libgobuster/http_test.go (the host, HOST and -nch cases fail without the change)
• go vet ./..., go test -race -cover ./..., gofumpt -l ., golangci-lint run ./...
• Manual check against a local server with dir and fuzz mode: Host is target.local for host:, HOST: and -nch -H 'host: ...'

[firefart]

thanks!