Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
github.com/blurty/sftp
通过UDP来在两台服务器之间传输文件。
client, err := sftp.NewClient("127.0.0.1:22345")
sentBytes, err := client.SendFile(path)
客户端发起一个读或写请求,请求内容包括:
服务端收到请求,响应一个ack包,如果是读请求,包内容包括:
如果是写请求,包内容包括:
客户端收到响应之后,如果是读请求,响应ack code应该是ackSame,ackNSame,ackNPermit,ackNExist中的一种:
如果是写请求,响应ack code应该是ackSame,ackNSame,ackNPermit,ackNExist中的一种:
服务器如果在等待响应。则根据以上具体响应内容决定是否继续传输以及传输开始位置。
启动两个goroutine,一个用来发数据,一个用来收数据的确认。
模仿TCP,实现一个弱化版的窗口机制。
blockNum*blockSize是窗口大小。
不同于tcp的时延确认,每个数据包都要确认一次。
Inspired by tftp
tftp implemented by pin is very good. I don't intend to modify it, but just to add some controls on UDP to assure file tranfer.
Document will given later...
Code is in progress, so it will continue evolving little by little and at this point I'm not really looking for contributions.
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.