Mismatch between signed headers and request headers

[summersamara]

Problem:
Verification of the fuzzer's request signature fails when the target's host includes a port number.

Cause:
When building the parameters required for signing the request, the fuzzer retrieves the value of the host parameter from URL.hostname which does not include the port number as opposed to the Host header value which does include the port number.

This is resulting in a mismatch between the signed headers and the request headers being sent.

Proposed Solution:
Retrieve the value of the host parameter used for signing the request from URL.host instead of URL.hostname

activitypub-fuzzer/signature.js

Line 48 in 4d63714

const hostParam = urlObj.hostname;