Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
httpdbg
is a tool for Python developers to easily debug the HTTP(S) client requests in a Python program.
To use it, execute your program using the pyhttpdbg
command instead of python
and that's it. Open a browser to http://localhost:4909
to view the requests:
Full documentation => https://httpdbg.readthedocs.io/
pip install httpdbg
Open an interactive console using the command pyhttpdbg
.
(venv) dev@host:~/dir$ pyhttpdbg
.... - - .--. -.. -... --. .... - - .--. -.. -... --. .... - - .--. -.. -... --.
httpdbg - HTTP(S) requests available at http://localhost:4909/
.... - - .--. -.. -... --. .... - - .--. -.. -... --. .... - - .--. -.. -... --.
Python 3.10.6 (main, Aug 10 2022, 11:40:04) [GCC 11.3.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
(InteractiveConsole)
>>>
Perform HTTP requests.
You can inspect the HTTP requests directly in your web browser at http://localhost:4909.
You can trace all the HTTP requests performed by a script
pyhttpdbg --script filename.py [arg1 --arg2 ...]
You can trace all the HTTP requests performed during your tests
pyhttpdbg -m pytest [arg1 --arg2 ...]
If you use the pytest-xdist
plugin to execute your tests in parallel, then you must install the pytest-httpdbg
plugin if you want to trace the requests done by the pytest workers.
pip install httpdbg[pytest]
You can trace all the HTTP requests performed by a library module run as a script using the -m
command line argument.
For example, you can view which HTTP requests are performed by pip
when you install a package.
pyhttpdbg -m pip install hookdns --upgrade
An initiator is the function/method that is at the origin of the HTTP requests. By default, we already support some packages but you can add your own initiators.
To add a new package in the list of initiators, you can use the -i
command line argument:
pyhttpdbg -i api_client_pck --script my_script.py
You can use any package as an initiator, this is not limited to HTTP requests.
packages | status |
---|---|
requests | supported |
urllib3 | supported |
httpx | supported |
aiohttp | supported |
pytest | supported |
your_package | yes, with the arg -i your_package |
No configuration is necessary to start but some few settings are available for particular use.
usage: pyhttpdbg [-h] [--host HOST] [--port PORT] [--version] [--initiator INITIATOR] [--keep-up | --force-quit]
[--console | --module MODULE | --script SCRIPT]
httdbg - a very simple tool to debug HTTP(S) client requests
options:
-h, --help show this help message and exit
--host HOST the web interface host IP address
--port PORT, -p PORT the web interface port
--version, -v print the httpdbg version
--initiator INITIATOR, -i INITIATOR
add a new initiator (package)
--keep-up, -k keep the server up even if the requests have been read
--force-quit, -q stop the server even if the requests have not been read
--console run a python console (default)
--module MODULE, -m MODULE
run library module as a script (the next args are passed to pytest as is)
--script SCRIPT run a script (the next args are passed to the script as is)
Clic on the ⚙ button on the top right of the page.
Some options are available:
To keep your configuration, bookmark the page with the full search query.
Fox example, if you want to hide the initiator rows by default, the url will be:
http://localhost:4909/?hi=on
All the requests recorded are available on the web interface.
The requests:
FAQs
A very simple tool to debug HTTP(S) client requests
We found that httpdbg demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.