Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
github.com/getlantern/http-proxy-archived
First get dependencies:
go get -t
Then run with:
go run http_proxy.go
This proxy is built around the classical Middleware pattern. You can see examples in the forward
and httpconnect
packges. They can be chained together forming a series of filters.
See this code snippet:
// Middleware: Forward HTTP Messages
forwarder, err := forward.New(nil, forward.IdleTimeoutSetter(time.Duration(*idleClose)*time.Second))
if err != nil {
log.Error(err)
}
// Middleware: Handle HTTP CONNECT
httpConnect, err := httpconnect.New(forwarder, httpconnect.IdleTimeoutSetter(time.Duration(*idleClose)*time.Second))
if err != nil {
log.Error(err)
}
...
Additionally, this proxy uses the concept of connection wrappers, which work as a series of wrappers over the listeners generating the connections, and the connections themselves.
The following is an extract of the default listeners you can find in this proxy. You need to provide functions that take the previous listener and produce a new one, wrapping it in the process. Note that the generated connections must implement StateAwareConn
. See more examples in listeners
.
srv.AddListenerWrappers(
// Limit max number of simultaneous connections
func(ls net.Listener) net.Listener {
return listeners.NewLimitedListener(ls, *maxConns)
},
// Close connections after 30 seconds of no activity
func(ls net.Listener) net.Listener {
return listeners.NewIdleConnListener(ls, time.Duration(*idleClose)*time.Second)
},
)
go test
Use this for verbose output:
TRACE=1 go test
*Keep in mind that cURL doesn't support tunneling through an HTTPS proxy, so if you use the -https option you have to use other tools for testing.
Run the server as follows:
go run http_proxy.go
Test direct proxying with cURL:
curl -kvx localhost:8080 http://www.google.com/humans.txt
curl -kvx localhost:8080 https://www.google.com/humans.txt
Test HTTP connect with cURL:
curl -kpvx localhost:8080 http://www.google.com/humans.txt
curl -kpvx localhost:8080 https://www.google.com/humans.txt
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.