Hacker Read

devit · 2017-12-06 22:04:37+00:00

Just run it in a separate process with a seccomp sandbox, using pipe/socket IPC with a timeout (if it's some anti-DoS/intrusion thing, just fail allowing the request, since it's going to have false negatives anyway).

The IPC cost should not be significant compared to the rest of the web server code.

Can also ask them to do the work and provide a small open source in-process shim that sets up and talks to the sandboxed process.

reply

bombcar | karma 42761 | avg karma 2.58 · | 2021-06-08 03:08:04+00:00

You could modify the web server to modify the code in a similar way to the reflections paper.

But even more imaginative would be to work it into the kernel or the ssl layer somehow.

reply

nickpsecurity | karma 14152 | avg karma 1.39 · | 2016-03-22 00:12:06

That was the intent and solution I had in mind. Appreciate the positive feedback as I might do it myself given all the ridiculously tiny web servers people have made.

My favorite trick I saw was one that replied directly with TCP/IP packets pre-encoded from the HTML. Cool, huh? That could even be done with highly assured tools in safer language as part of CMS or web build system.

reply

johncolanduoni | karma 4429 | avg karma 2.63 · | 2023-08-06 22:15:07

The usual process is for your script to do an OAuth flow on an embedded web server with Okta or whatever, and to port forward that embedded server to your client machine. VS code remote handles this pretty well for example.

cridenour | karma 504 | avg karma 2.7 · | 2014-09-17 16:17:47+00:00

You _could_ run a local webserver, but that may not be worth it speed wise. Depends on your code.

badideaprojects | karma 81 | avg karma 2.7 · | 2019-02-22 14:58:11+00:00

I’m sure this exists. We have legacy command line scripts that run continuously to support various internal processes.

I’m looking for a web based solution to do the following:

- Start whitelisted processes - Stop whitelisted processes - Live output from the processes in the browser while they are running - Authentication (optional, can hide behind SSH or use client certs if required) - Audit log (optional, nice to have)

reply

johtso | karma 824 | avg karma 3.05 · | 2021-07-11 18:24:08

Are there any tools to run an untrusted client side web application isolated from the internet?

asjfkdlf | karma 405 | avg karma 15.0 · | 2016-04-10 16:22:16

That would be a good first step. It would have to be a subset of CSP. Don't allow inline scripts or eval.. Only on https is another step I see as very important.

hrrsn | karma 1003 | avg karma 2.48 · | 2013-11-19 11:34:08+00:00

It would be easier just to write a script that makes repeated requests and running that since it's just HTTP anyway

andix | karma 2973 | avg karma 2.45 · | 2023-02-06 08:14:26

Just don’t do it then. Either ship something electron based (or similar) with an embedded browser and IPC communication with the bundled „backend“, or communicate via a trusted server.

Listening on localhost is a security nightmare, also because it is accessible from other user accounts on the same machine. The server probably can do some privileged tasks (otherwise you wouldn’t need it) and could be hijacked by malware.

reply

mfincham | karma 1318 | avg karma 7.57 · | 2022-06-28 21:36:04

Google's nsjail (https://github.com/google/nsjail) has a nice "inetd style" mode where it can launch a sandboxed process in response to a TCP connection for similar use cases to this (and is relatively quick to fire up).

mdakin | karma 557 | avg karma 2.5 · | 2008-10-05 21:21:34+00:00

I have done something like this. I interfaced with Apache however rather than also writing the web server by hand. I also leveraged libraries when I could.

You may want to investigate the following libraries:

fcgi++: Interface with the web server using fast cgi; keep the program resident in memory between requests.

botan: For generating cryptographic hashes.

cgicc: For handling input from the web browser.

xerces-c: For implementing a templating system and generating the output which gets sent to the web browser.

libpqxx: Interfacing with Postgres.

cppunit: Unit-testing critical or difficult-to-test bits.

It's not as hard as everyone likes to make it sound (assuming you are on the right side of the C++ learning curve). The real question is whether you want to spend your time writing a framework rather than actual applications.

reply

amanzi | karma 3630 | avg karma 4.25 · | 2018-02-26 03:20:50+00:00

Yes, agree with that - I've created a mini web server in C# before, but I wouldn't want to expose that to the internet.

cdcarter | karma 1969 | avg karma 2.05 · | 2013-06-30 17:34:27+00:00

Then use a library or local call. For web based projects with low security concerns or something reminiscent of Yahoo! Pipes this is pretty cool.

tomatowurst | karma 627 | avg karma 1.72 · | 2022-05-04 14:29:57

absolutely insane. seems like its installing pip packages and running localhost in the browser? I don't 100% grasp what is happening underneath the hood. But usually you would launch the local server, browse over to http://localhost to view it in your browser. This is running the web server inside Web Assembly inside your browser? Is it then possible to expose that local web server inside web assembly to the internet? Crazy stuff! looks like its possible to speed up the initial load time by using web workers, very much eager to see that in action.

    Loading...
    distutils already loaded from default channel
    Loading micropip, pyparsing, packaging
    Loaded micropip, pyparsing, packaging
    Loading ssl, openssl
    Loaded ssl, openssl
    distutils already loaded from default channel
    pyparsing already loaded from default channel
    Loading setuptools
    Loaded setuptools

diginux | karma 174 | avg karma 3.78 · | 2013-02-16 18:34:56+00:00

I still have to know the IP of my machine, make a script wrap around python and wget or curl to achieve the bcp functionality.

I actually use SimpleHTTPServer a lot for other things though, it is a great tip.

reply

troyjfarrell | karma 105 | avg karma 2.84 · | 2023-05-08 10:22:09

You've just described Sandstorm. Sandstorm runs instances (called grains) of applications in a sandbox. The application gets a limited file system and a Cap'n Proto RPC connection to the outside world over a unix socket. Sandstorm runs the HTTPS server, which turns requests into RPC calls. Sandstorm authenticates the users and provides temporary subdomains and frames to sandbox the HTML side of it.

https://sandstorm.io/

reply

Fluxx | karma 675 | avg karma 5.87 · | 2011-04-21 11:13:05

You could do that, including figuring out your NAT/Firewall, how to proxy through apache to your app and have to worry about security. Or, you could just do this:

  show 3100

I dunno, I'm a busy dude and my time isn't free. So I'd rather pay $5 a month to have someone figure this out for me and let me spend time leveraging it to build cool stuff of my own.

x4e31 | karma -9 | avg karma -1.5 · | 2013-04-03 14:22:18+00:00

i dont need the web server response and i just want to send a ip spoofed http packet. i dont care about the programming language, so any source code or program are welcome.

kgeist | karma 3004 | avg karma 3.25 · | 2022-05-22 01:11:41

My first thought was to abuse the Web client. Run a server somewhere which hooks into JS in headless Chrome, parses commands and sends messages (requires a dummy user). The client could be based on the Web client, too. But I'm not sure if it's feasible and it's probably against the Terms of Use.