Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
本地webserver优先寻找对应的本地资源, 如果没找到则会走转发规则,转发规则也没找到才会返回404.
这样假设你有这样一个项目: 本地有如下文件
project
--- index.html
--- list.json
targetServer上有如下文件
targetServer
--- detail.html
--- detail.json
以peoject目录作为basePath,启动bird server,那么访问localhost:8008/index.html
就会加载本地的index.html页面, 访问localhost:8008/detail.html
就会加载服务端的页面,ajax请求list.json
,返回的是本地的list.json
, 请求detail.json
,则返回服务器上的detail.json
。
这样就通过代理服务器绕过了跨域限制。
在targetServer中配置身份校验信息,则可以帮助我们联调一些需要身份验证的接口
"headers": {
"cookie": "xplatform_ge=4ffcc236a075c3e1f5068f172f654bbe9a1f23adc1563138c432b72b0d06261a153cc6f5a40"
}
可以通过配置规则,走一些特殊的转发规则,请参见下面的使用手册。
1、创建一个config.js文件(名称任意)
var bird = require('gulp-bird');
//静态服务器配置,可同时配置多个,域名需host到127.0.0.1
var server = {
"8008": {
//静态文件根目录
"basePath": "/Users/baidu/Desktop/frontEnd/Baidu/Hi-new-backend/src",
// 是否开启调试模式,true(表示server端不缓存),false(反之)
"debug": true,
//忽略的静态文件请求,与此正则匹配的请求将直接走转发规则(可选配置)
"ignoreRegExp": /\/js\/urls\.js/g
}
};
//转发规则——静态服务器没有响应的或者忽略的请求将根据一下规则转发
var transpondRules = {
"8008": {
//目标服务器的ip和端口,域名也可,但注意不要被host了
targetServer: {
"port": "8274",
"host": "cp01-hiserver-sandbox1-tc.cp01.baidu.com",
"replaceHeaders": true, //当为true时,如果cookie or header中有相同key,则替换
"headers": {
"cookie": "xplatform_ge=4ffcc236a075c3e1f5068f172f654bbe9a1f23adc1563138c432b72b0d06261a153cc6f5a40"
}
},
//特殊请求转发,可选配置,内部的host、port和attachHeaders为可选参数
regExpPath: {
"/hrlms/rs": {
//"host": "10.44.67.14",
//"port": "8045",
//"attachHeaders": {"app-id": 5},
"path": "/hrlms/rs"
}
}
},
"ajaxOnly": false
};
var weinre = {
open: true,
port: 8080
}
bird.start(server, transpondRules, weinre);
2、用node执行它
node config.js
FAQs
bird-v2
We found that gulp-bird demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.