Research
Security News
Quasar RAT Disguised as an npm Package for Detecting Vulnerabilities in Ethereum Smart Contracts
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
github.com/projectdiscovery/retryablehttp-go
Heavily inspired from https://github.com/hashicorp/go-retryablehttp.
Example of using retryablehttp
in Go Code is available in examples folder
Examples of using Nuclei From Go Code to run templates on targets are provided in the examples folder.
retryablehttp.Request
by default handles some url encoding and parameters issues. since http.Request
internally uses url.Parse()
to parse url specified in request it creates some inconsistencies for below urls and other non-RFC compilant urls
// below urls are either normalized or returns error when used in `http.NewRequest()`
https://scanme.sh/%invalid
https://scanme.sh/w%0d%2e/
scanme.sh/with/path?some'param=`'+OR+ORDER+BY+1--
All above mentioned cases are handled internally in retryablehttp
.
It is not recommended to update url.URL
instance of Request
once a new request is created (ex req.URL.Path = xyz
) due to internal logic of urls.
In any case if it is not possible to follow above point due to some reason helper methods are available to reflect such changes
Request.Update()
commits any changes made to query parameters (ex: Request.URL.Query().Add(x,y)
)FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Security News
Research
A supply chain attack on Rspack's npm packages injected cryptomining malware, potentially impacting thousands of developers.
Research
Security News
Socket researchers discovered a malware campaign on npm delivering the Skuld infostealer via typosquatted packages, exposing sensitive data.