Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
httpsuite
is a collection of tools to parse, manipulate, and compile raw HTTP messages. Built to be used as a dependency for larger projects that require parsing, modifying, requesting, and responding to raw HTTP requests.
To install just httpsuite
:
pip install httpsuite
This package is depedent on toolbox
. If you plan to contribute make sure to install the dev
requirements:
pip install httpsuite[dev]
Read the documentation here.
httpsuite
provides two main objects, Request
and Response
. Both objects can be initialized with either __init__
or parse
:
from httpsuite import Request, Response
import json
request = Request(
method="GET",
target="/",
protocol="HTTP/1.1",
headers={"Host": "www.google.com", "Connection": "keep-alive", "Content-Length": "18"},
body=json.dumps({"hello": "world"}),
)
response = Response(
protocol="HTTP/1.1",
status=200,
status_msg="OK",
headers={"Host": "www.google.com", "Connection": "keep-alive", "Content-Length": "18"},
body=json.dumps({"hello": "world"}),
)
or
from httpsuite import Request, Response
request = Request.parse(
(
b"GET / HTTP/1.1\r\n"
b"Host: www.google.com\r\n"
b"Connection: keep-alive\r\n"
b"Content-Length: 18\r\n"
b"\r\n"
b'{"hello": "world"}'
)
)
response = Response.parse(
(
b"HTTP/1.1 200 OK\r\n"
b"Host: www.google.com\r\n"
b"Connection: keep-alive\r\n"
b"Content-Length: 18\r\n"
b"\r\n"
b'{"hello": "world"}'
)
)
Request
and Responses
objects can be directly modified as one would expect, with no limitations as to the type:
request.method = "POST"
request.headers += {"Accept": "*/*"}
response.status = 100
response.status_msg = b"Continue"
Internally, every item of a request or response is saved as an Item
, a special object type that allows easy setting and comparisons on the fly:
response.status == 100 # >>> True
response.status == "100" # >>> True
response.status == b"100" # >>> True
Once the object is modified to the users preference, utilizing the Request
and Response
object is as easy as calling a property (specifically .raw
):
print(request.raw)
# >>> b'POST / HTTP/1.1\r\nHost: www.google.com\r\nConnection: keep-alive\r\nContent-Length: 18\r\nAccept: */*\r\n\r\n{"hello": "world"}'
print(response.raw)
# >>> b'HTTP/1.1 100 Continue\r\nHost: www.google.com\r\nConnection: keep-alive\r\nContent-Length: 18\r\n\r\n{"hello": "world"}'
Uniquely, the __str__
method for Request
and Response
return the objects with arrows to make obvious of its type:
print(request)
print(response)
→ POST / HTTP/1.1
→ Host: www.google.com
→ Connection: keep-alive
→ Content-Length: 18
→ Accept: */*
→
→ {"hello": "world"}
← HTTP/1.1 100 Continue
← Host: www.google.com
← Connection: keep-alive
← Content-Length: 18
←
← {"hello": "world"}
For more information and examples of httpsuite
, check out the docs.
FAQs
Collection of tools to parse, manipulate, and compile raw HTTP messages.
We found that httpsuite demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.