Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
com.googlecode.httpliar:httpliar
Advanced tools
Http Liar 项目是基于HTTP Proxy工作模式的一款HTTP协议拦截、篡改工具,可以基于这个工具进行针对网页的实时修改。代理性能并不是这个工具的强项,相反Http Liar对HTML、CSS、JavaScript、JSON等文本块的识别和加载以及对HTTP的解压缩行为会让网页的性能有所降低。不建议使用在性能要求非常高的场景。
HttpLiar是基于HttpProxy的工作模式,所以数据流转中也承担着承上启下的环节。
HTTP的应答会在压缩之后拆分成多个Chunked的方式进行传递,作为一个Proxy如果不需要关注内部数据只需要将流经的数据包最快的传走即可。但对于HttpLiar而言我们需要了解和修改应答的数据,所以HttpLiar需要对流经的数据像浏览器进行整合处理。这也是HttpLiar为什么性能提升不上来的原因。
对于应答所返回的数据,HttpLiar抽象成了DataBlock(二进制块)。
作为独立的HttpProxy进行部署
./java -jar httpliar-jar-with-dependencies.jar
作为内嵌应用,HttpLiar已经上传到Maven中心仓库 在pom.xml中添加
<dependency>
<groupId>com.googlecode.httpliar</groupId>
<artifactId>httpliar</artifactId>
<version>1.0.1</version>
</dependency>
编写Java代码
public static void main(String[] args) throws Exception {
final Configer configer = getConfiger(args);
@SuppressWarnings("unchecked")
final HttpLiarServer server = new HttpLiarServer(configer);
JvmUtils.registShutdownHook("httpliar-shutdown", new ShutdownHook(){
@Override
public void shutdown() throws Throwable {
server.stopProxy();
}
});
server.startProxy();
}
FAQs
HttpLiar - Java Http Proxy
We found that com.googlecode.httpliar:httpliar demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.