
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
github.com/signeen/inspect-http-proxy
A simple yet powerful Go-based reverse HTTP proxy designed for detailed inspection of requests and responses. It logs traffic to the console with colorization, automatic decompression, and formatting for common content types, while remaining transparent to the client application.
Ideal for debugging API interactions, understanding middleware behavior, or simply getting a clear view of HTTP traffic flow.
gzip
, br
(Brotli), and deflate
encoded response bodies before logging, allowing you to see the actual content easily.application/x-www-form-urlencoded
bodies.-listen
).-target
).-truncate-log-body
).Authorization
header value in logs.X-Forwarded-For
, X-Forwarded-Proto
, and X-Forwarded-Host
headers to the request sent to the target.You can install the proxy directly using go install
:
go install github.com/signeen/inspect-http-proxy@latest
Alternatively, you can clone the repository and build it manually:
git clone https://github.com/signeen/inspect-http-proxy.git
cd inspect-http-proxy
go build
Run the proxy from your terminal, specifying the target URL.
inspect-http-proxy -target <target-url> [flags]
Flags:
-listen <address:port>
: Address and port for the proxy to listen on. (Default: :20003
)-target <url>
: URL of the target server to forward requests to. (Required, e.g., http://localhost:8080
, https://api.example.com
)-truncate-log-body
: If set, truncate the logged body output string to a predefined limit (currently 10KB). (Default: false
)Examples:
Proxy to a local backend API:
inspect-http-proxy -target http://localhost:8080
Now send requests to http://localhost:20003
instead of http://localhost:8080
.
Listen on a different port and proxy to HTTPS:
inspect-http-proxy -listen :9999 -target https://jsonplaceholder.typicode.com
Send requests to http://localhost:9999
.
Proxy and truncate long log bodies:
inspect-http-proxy -target http://my-verbose-api:5000 -truncate-log-body
Here's a sample of what the console output might look like (colors omitted for basic Markdown):
--- Incoming Request ---
Time: 2025-04-04T10:30:01Z
From: 127.0.0.1:54321
Request: POST /api/v1/users HTTP/1.1
Host: localhost:20003
Query Parameters:
source: web
Request Headers:
Accept: application/json
Accept-Encoding: gzip, deflate, br
Authorization: [REDACTED SHORT]
Content-Length: 55
Content-Type: application/json
User-Agent: curl/7.79.1
Request Body: (decoded from json for printing)
{
"email": "test@example.com",
"name": "Test User"
}
------------------------
--- Target Response ----
Status: 201 Created (201)
Response Headers:
Content-Encoding: gzip
Content-Type: application/json; charset=utf-8
Date: Fri, 04 Apr 2025 10:30:01 GMT
Location: /api/v1/users/123
Server: Caddy
Vary: Accept-Encoding
Response Body: (decoded from gzip for printing)
{
"id": "123",
"message": "User created successfully",
"timestamp": "2025-04-04T10:30:01.500Z"
}
Duration: 55.123456ms
-----------------------
=======================
--- Incoming Request ---
Time: 2025-04-04T10:31:05Z
From: 127.0.0.1:54322
Request: GET /api/v1/items?limit=10 HTTP/1.1
Host: localhost:20003
Query Parameters:
limit: 10
Request Headers:
Accept: */*
Accept-Encoding: gzip
User-Agent: Wget/1.21.1
Request Body: (empty)
------------------------
--- Target Response ----
Status: 200 OK (200)
Response Headers:
Content-Length: 25000
Content-Type: application/json
Date: Fri, 04 Apr 2025 10:31:05 GMT
Server: nginx
Response Body: (decoded from json for printing)
[
{
"id": "item1",
"value": "..."
},
{
"id": "item2",
"value": "..."
}
// ... more items
]
... (Output truncated for display, original data size 25000 bytes)
Duration: 12.987654ms
-----------------------
=======================
Contributions are welcome! Please feel free to open an issue to report bugs or suggest features, or submit a pull request with improvements.
This project is licensed under the GNU General Public License v3.0 - see the LICENSE file for details.
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.