HTTP, HTTP2, HTTPS, Websocket debugging proxy

English | 简体中文

whistle logo

We recommend updating whistle and Node to ensure that you receive important features, bugfixes and performance improvements. Some versions of Node have bugs that may cause whistle to not work properly, for detail see the issue: #231

whistle

NPM version node version build status Test coverage npm download NPM count License

中文 README

whistle is a cross-platform web debugging tool based on Node.js.

It features the following:

  1. offer HTTP proxying
  2. capture, replay or compose requests of HTTP, HTTPS, WebSocket and TCP.
  3. manipulate http request and response by configing hosts, or patterns like domain, path, regular expression, wildcard characters, wildcard path, etc.
  4. offer build-in mobile debugging mode

If the aboves can't satisfy your requirements, you can also use plugins to extend its capabilities.

The specific functions are as follows:

specific functions

Manipulations to http request and response in whistle can be achieved as a Rule looks like:

pattern operatorURI

Description:

  1. pattern is an expression to match the target request url. You can write patterns in different forms including domain, path, regular expression, wildcard, and so on.

     # matching domain
     www.example.com
     # domain with port
     www.example.com:6666
     # domain with protocol, supporting http, https, ws, wss, tunnel
     http://www.example.com
    
     # matching path, supporting protocol, port
     www.example.com/test
     https:/www.exapmle.com/test
     https:/www.exapmle.com:6666/test
    
     # matching regular expression
     /^https?://www\.example\.com\/test/(.*)/ referer://http://www.test.com/$1
    
     # matching wildcard
     ^www.example.com/test/*** referer://http://www.test.com/$1
    

    For more details, please visit Pattern Matching

  2. operatorURI is the corresponding operation, made up of opProtocol and opValue:
    opProtocol represents the kind of operation, e.g.

     # host:setting requested server IP
     pattern host://opValue
    
     # file:using the local file to replace
     pattern file://opValue
    

    opValue represents the parameters of the specific operation, e.g.

     # host:setting requested server IP
     pattern host://127.0.0.1:6666 # or pattern 127.0.0.1:6666	
    
     # file:using the local file to replace
     pattern file:///User/test/dirOrFile # or pattern /User/test/dirOrFile
     pattern file://E:\test\dirOrFile # or pattern E:\test\dirOrFile
    

    For more details, please visit operation value

  3. The position of pattern and operatorURI can be swapped in most situations while the combination mode is also supported. For more details, please visit configuration mode

Install & Setup

install Node

The latest LTS version of Node.js is recommended.

If none or low version of Node.js is installed, you need install the latest version of Node.js according to the following instructions:

  1. For Windows: please visit https://nodejs.org/ to download the latest LTS version of Node.js and then, install it using the default options.

  2. For Mac: the same as Windows.

  3. For Linux: using source code to install is recommended, because in this way, you don't need to configure the path.  If you fail to install with source code, you can also use the binary version of Node.js directly.

    • with source package: visit Official website of Node to download the latest version of Source Code*(or using wget in shell), unzip(tar -xzvf node-xxx.tar.gz), switch to the root directory(cd node-xxx), execute ./configure, ./make and ./make install in order。
    • using binary version:visit Official website of Node to download the latest Linux Binaries(or using command wget to download), unzip(tar -xzvf node-xxx.tar.gz), add the absolute path of bin directory to system PATH after extracting。

You can execute node -v in shell to check if the expected version of Node.js is installed successfully:

$ node -v
v8.9.4

install whistle

After the Node.js is installed successfully, you can execute the following npm command to install whistle(In Mac or Linux, prefix sudo is needed if you are not root user, i.e. sudo npm install -g whistle

npm install -g whistle

In China, you can install whistle using npm mirror of taobao to speed up installing progress and avoid failure:

npm install cnpm -g --registry=https://registry.npm.taobao.org
cnpm install -g whistle

or specify mirror install directly:
npm install whistle -g --registry=https://registry.npm.taobao.org

After installation, execute whistle help or w2 help to view help information:

$ w2 help
Usage: whistle <command> [options]


Commands:

	run       Start a front service
	start     Start a background service
	stop      Stop current background service
	restart   Restart current background service
	help      Display help information

Options:

	-h, --help                                      output usage information
	-D, --baseDir [baseDir]                         the base dir of config data
	-z, --certDir [directory]                       custom certificate path
	-l, --localUIHost [hostname]                    local ui host (local.whistlejs.com by default)
	-n, --username [username]                       the username of whistle
	-w, --password [password]                       the password of whistle
	-N, --guestName [username]                      the guest name
	-W, --guestPassword [password]                  the guest password
	-s, --sockets [number]                          max sockets (60 by default)
	-S, --storage [newStorageDir]                   the new local storage directory
	-C, --copy [storageDir]                         copy storageDir to newStorageDir
	-c, --dnsCache [time]                           the cache time of DNS (30000ms by default)
	-H, --host [host]                               whistle listening host(:: or 0.0.0.0 by default)
	-p, --port [port]                               whistle listening port (8899 by default)
	-P, --uiport [uiport]                           whistle ui port (8900 by default)
	-m, --middlewares [script path or module name]  express middlewares path (as: xx,yy/zz.js)
	-M, --mode [mode]                               the whistle mode (as: pureProxy|debug|multiEnv)
	-t, --timeout [ms]                              request timeout (66000 ms by default)
	-e, --extra [extraData]                         extra data for plugin
	-f, --secureFilter [secureFilter]               the script path of secure filter
	-R, --reqCacheSize [reqCacheSize]               the cache size of request data (512 by default)
	-F, --frameCacheSize [frameCacheSize]           the cache size of socket frames (512 by default)
	-V, --version                                   output the version number

Setup whistle

Start:

w2 start

Note: If you don't want others to visit the configuration page of whistle, just add username and password when start, i.e. -n yourusername -w yourpassword

Restart:

w2 restart

Stop:

w2 stop

Debugging mode:

w2 run

For more details, please visit install and start

Proxing Settings

configuring server & port
  1. proxying server:127.0.0.1(if whistle is deployed in remote server or virtual machine, change this address to corresponding IP address)
  2. default port:8899(if port 8899 is used already, you can specify new port using -p when start. More details can be visited by executing whistle help or w2 help (only supported in v0.7.0 and higher version)

Make sure using the same proxying server for all protocol in system proxying setting is checked.

Browser & System configuration
  1. proxy setting in OS: 
  1. proxy setting in browser(recommended)

    • for Chrome:intall chrome plugin whistle-for-chrome or Proxy SwitchySharp

    • for Firefox: Open Options page in Firefox, then switch to General -> Network Proxy, then set Manual proxy configuration to whistle.

  2. in mobiles, configure the proxy of current Wi-Fi in Setting

PS: The mobile may failed to use network after configuration because the fireworks of the PC has forbidden remote visit to the whistle's port. you can try to close the fireworks or configure white list : http://jingyan.baidu.com/article/870c6fc317cae7b03ee4be48.html

For more details, please vsit install and start

Visit whistle's operation page

After the above steps are completed, open the whistle page in browserhttp://local.whistlejs.com

whistle webui

There are five main tabs in the navigation bar:

  1. Network
  • check and compose the http request
  • show the console print and javascript errors thrown in pages
  1. Rules:configure rules for manipulating
  2. Plugins
  • show the list of installed plugins
  • enable or disable installed plugins
  1. Weinre:configure Weinre list
  2. HTTPS:
    • configure whether or not to intercept the HTTPS and download the root certificate for whistle

Certificate Installment

Please install root certificate and enable HTTPS interception before using whislte.

For more details, please vsit Certificate Installment

Quick start

Open Rules tab in whistle, and create a group named test by context menu or Create button in menu bar. Then follow the next steps to write rules and save.

  1. cofigure hosts

    Specify the ip of www.ifeng.com:

     www.ifeng.com 127.0.0.1
     # or
     127.0.0.1 www.ifeng.com
    

    Specify the ip and port of www.ifeng.com to forward http request to local port 8080. In this way, we can visit the local website just as online when the developing port is not 80:

     # www.ifeng.com 127.0.0.1
     www.ifeng.com 127.0.0.1:8080
     # or
     127.0.0.1:8080 www.ifeng.com
    

    We can also replace the real IP (or domain) and port with any domain without port:

     www.ifeng.com host://www.qq.com:8080
     # or
     host://www.qq.com:8080 www.ifeng.com
    

    For more details, please visit Pattern Matching

  2. local files replacing

Replace the response with content in local file system, which is frequently used during web developing.

# Mac or Linux
www.ifeng.com file:///User/username/test
# or www.ifeng.com file:///User/username/test/index.html
	
# Both '\' and '/' can be used as path separator for Widows
www.ifeng.com file://E:\xx\test
# or www.ifeng.com file://E:\xx\test\index.html

http://www.ifeng.com/ will try to load /User/username/test first. If the former dosen't exist, the file /User/username/test/index.html will be loaded. For neither exists, it returns 404.

To replace jsonp request, you can refer to tpl

For more details, please vsit Pattern Matching

  1. Request Forward

    To forward all the requests from domain www.ifeng.com to domain www.aliexpress.com

     www.ifeng.com www.aliexpress.com
    

    For more details, Pattern Matching

  2. Inject html、js、css

    whistle will decide whether injecting corresponding text and how to inject, like whether wrapping the text with HTML label, automatically according to response type.

     # Mac、Linux
     www.ifeng.com html:///User/xxx/test/test.html
     www.ifeng.com js:///User/xxx/test/test.js
     www.ifeng.com css:///User/xxx/test/test.css
     
     # Both '\' and '/' can be used as path separator for Widows
     www.ifeng.com html://E:\xx\test\test.html
     www.ifeng.com js://E:\xx\test\test.js
     www.ifeng.com css://E:\xx\test\test.css
    

    For all the requests for domain www.ifeng.com, whistle will inject the processed text to response body according to response type. If the type is HTML, the js content will be wrapped within script, and the css content be wrapped within style to be injected to response body。

    For more details, Pattern Matching

  3. Debug for remote page

    With the protocol weinre and protocol log provided by whistle, you can modify the DOM structure, capture the javascript errors and view the console print easily. Moreover, you can inject specified script to debug the remote page.

    Before using whistle to debug remote page, you need to set the proxy for OS or browser to whistle. Please refers Install and start to know how to set the proxy.

    For weinre:

     www.ifeng.com weinre://test
    

    Add the following rule in group named test and save, open the www.ifeng.com with a new tab in browser. Then you can see a list when you hover over the button weinre, click the item test to open a weinre debug page. For example, you can see the DOM structure when swich to Elements tab after selected a target.

    For log:

     www.ifeng.com log://{test.js}
    

    Add the following rule in group named test and save. Then you can see a list when you hover over the button Values, whistle will create a group named test.js in Values when you click it. Input the text console.log(1, 2, 3, {a: 123}) in the group editor, open the Network -> Log -> Console, open the www.ifeng.com, you can see the output '1, 2, 3, {a: 123}' in Console panel.

    For more details, Pattern Matching and Rules

Documentation

  1. Install and start
  2. CLI operation
  3. How to update
  4. Quickly start
  5. Configuration mode
  6. Pattern Matching
  7. Operation value
  8. Frequent functions
  9. How to develop plugins
  10. Attentions
  11. Common questions
  12. Web UI
  13. Rules
  14. Feedback

License

MIT

Owner
avenwu
团队大量招前端,简历发我邮箱
avenwu
Comments
  • 安卓12根证书设置后还是提示证书有问题,httpcanary的根证书就没有问题

    安卓12根证书设置后还是提示证书有问题,httpcanary的根证书就没有问题

    安卓12根证书设置后还是提示证书有问题,httpcanary的根证书就没有问题

    通过以下命令生成.0结尾的根证书,并使用adb推送到了安卓设备上,httpcanary的根证书就可以正常抓包,但是whistle转换的就不行 `$ openssl x509 -inform PEM -subject_hash_old -in rootCA.crt | head -1

    $ cat rootCA.crt > 77e83b46.0

    $ openssl x509 -inform PEM -text -in rootCA.crt -out /dev/null >> 77e83b46.0`

  • 当安卓客户端 以protocol 协议为 http时,向后端 发起 websocket 请求,出现问题

    当安卓客户端 以protocol 协议为 http时,向后端 发起 websocket 请求,出现问题

    例如: 请求连接为 http://www.example.com 请求头为

    GET /index.html HTTP/1.1
    Host: www.example.com
    Connection: upgrade
    Upgrade: example/1, foo/2
    

    向后端发起websocket请求 用 whistle 抓包 protocol 显示为 http 后端服务 显示 此次连接 连接成功后马上断开

    但是同样的 请求 以fiddler 抓包 是能够正常连接后端的websocket服务 不断开的

    不知道作者大大能否排查一下原因呢

  • 支持 https 降级代理

    支持 https 降级代理

    平时我配置代理都是 ip domain 形式滴

    类似这种形式

    10.2.3.4 test.github.com
    

    如果访问 http://test.github.com 这个很正常,可以正确得到需要的东西,因为访问了 10.2.3.480 端口

    但是如果访问 https://test.github.com 就不正常了,这个时候 whistle 自动去访问了 10.2.3.4443 端口,但是因为内网机器上是不会部署证书滴,而且也只开放 80 端口

    所以我加了一个全局的 rule

    /^https:\/\/(.*)/i http://$1
    

    这样就可以 hack 把 443 端口强制改成访问 80 端口了

    但是问题来了,如果我想设置其他 rule 就不行了

    因为 rule 只能存在一个,所以就很麻烦

    如果你要让 https 降级 rule,就没办法自定义其他 rule 了

    如果要自定义 rule 就必须带上 https 转换,https -> http

    所以看一下这边有没有办法弄一个方法可以既满足 https 转 http,并且也支持自定义 rule

  • 像下面nginx这样转发怎么配置?

    像下面nginx这样转发怎么配置?

        location  ~.*\.(gif|jpg|jpeg|png|bmp|swf|ico|js|css|html)$
        {
            root   html;
            proxy_pass http://127.0.0.1:8080;
        }
        location / {
            root   html;
            proxy_pass http://192.168.30.118:8877;
    
    
        }
    
  • 使用中遇到了手机 qq 中截图的消息加载很慢问题

    使用中遇到了手机 qq 中截图的消息加载很慢问题

    不确定当前问题是我这边的个例,还是其他环境也是必现。

    环境

    MacOS 12.2.1 whistle 2.9.13 Android vivo S7 QQ v8.8.88.7830

    Win10也试过,存在同样的问题

    重现步骤

    电脑中启动 whistle,并在防火墙允许了监听的端口输入请求

    android 系统设置中 wifi 的代理配置http代理指向同局域网电脑的 whistle。

    android 中登录QQ。

    电脑中登录另外一个QQ号,跟手机中的QQ有好友关系、或者群友关系。

    从电脑中任意截图一个区域,将截图发给android的QQ。大小无所谓。一两百一两百的就够。我这边测试是 191104 的尺寸

    这时android的QQ收到一条图片消息。但是卡在加载中。而且这个加载会非常非常慢。平常不通过代理只要瞬间出现的图。现在可能需要加载几十秒。甚至几分钟才能加载完毕

    已经确认过如果不设置代理,直连使用时相同尺寸的其他截图时,是正常地很快加载完毕的!

  • whistle不生效

    whistle不生效

    试了很多次,重装N次,windows配置代理也不行

    1. 按照流程安装、启动;
    2. 启动成功;
    3. 打开默认页面无法访问;
    4. 本地ip+端口可以访问--http://本地IP:8899/#rules;
    5. network页面空白;
    6. 安装demo注入test.js,无效;
    7. 代理转发,无效;

    运行成功信息如下:

    • http://172.12.34.56:8899/可以正常打开界面,显示正常,但上述代理等功能无效;
    • http://local.whistlejs.com/无法访问;
    yunan.chen@DESKTOP-Q8CBUH8 MINGW64 /f/work/Jupiter-BSD (BSD_from_bugfix/20211217_UR)
    $ w2 proxy
    Setting global proxy (127.0.0.1:8899) successful.
    
    yunan.chen@DESKTOP-Q8CBUH8 MINGW64 /f/work/Jupiter-BSD (BSD_from_bugfix/20211217_UR)
    $ w2 start
    [!] [email protected] is running
    [i] 1. use your device to visit the following URL list, gets the IP of the URL you can access:
           http://127.0.0.1:8899/
           http://172.12.34.56:8899/
           Note: If all the above URLs are unable to access, check the firewall settings
                 For help see https://github.com/avwo/whistle
    [i] 2. set the HTTP proxy on your device with the above IP & PORT(8899)
    [i] 3. use Chrome to visit http://local.whistlejs.com/ to get started
    
    无法访问此网站local.whistlejs.com 拒绝了我们的连接请求。
    请试试以下办法:
    
    检查网络连接
    [检查代理服务器和防火墙](chrome-error://chromewebdata/#buttons)
    ERR_CONNECTION_REFUSED
    
  • [feature]能否支持一键开启全局代理配置

    [feature]能否支持一键开启全局代理配置

    背景

    目前使用 whistle 需要配合浏览器的代理插件使用,只能抓包浏览器请求,但如果想抓包其他软件,只能手动配置系统的网络代理

    期望

    希望 localhost:8899 whistle 管理平台支持一键开启/关闭系统代理功能

    解决方案

    目前了解到 win 下有个小工具可以通过指令开启/关闭代理,可以参考下[小工具链接] 手头没 mac,需要平台调研下了

  • 想开发一个以请求头中信息作为pattern的proxy插件

    想开发一个以请求头中信息作为pattern的proxy插件

    现在whistle的代理设置是这种形式 pattern proxy://ip:port 我想要开发一个插件,能够实现根据请求头中的某一个信息作为pattern使用代理 header_xxx my_proxy://ip:port 问题:

    1. 有没有相关的插件脚手架
    2. 如果我基于whistle源代码改造,能否麻烦大佬给予一些提示
  • weinre 是根据什么判断 html 的?

    weinre 是根据什么判断 html 的?

    系统是 mac,没开防火墙,使用weinre时,targets 是none,貌似要写手动写weinre的 js 才可以用,

    <script src="http://x.x.x.x:8901/target/target-script-min.js#anonymous"></script>
    
  • Debug 模式下启动出错

    Debug 模式下启动出错

    vscode 中,通过 「JavaScript Debug Terminal 」,执行启动命令,会在下面代码截图的分支中返回,导致启动无法正常完成。

    debug 代码发现,记录error 的文件中的内容为:Debugger attached. 看起来是把命令行中输出的这条debug信息也认为是错误信息了。

    image

  • Error: Parse Error: Duplicate Content-Length

    Error: Parse Error: Duplicate Content-Length

    From: [email protected]
    Node: v16.1.0
    Date: 2021/6/7 下午12:05:30
    Error: Parse Error: Duplicate Content-Length
        at TLSSocket.socketOnData 
    
    - [ ] 
    
    - [ ] (node:_http_client:487:22)
    
        at TLSSocket.emit (node:events:365:28)
        at addChunk (node:internal/streams/readable:314:12)
        at readableAddChunk (node:internal/streams/readable:289:9)
        at TLSSocket.Readable.push (node:internal/streams/readable:228:10)
        at TLSWrap.onStreamRead (node:internal/stream_base_commons:190:23)
    

    使用whistle代理的时候,遇到包这个错,请求响应直接502了;换charles代理是正常的。

    请求/响应头里没有Content-Length

    请求headers

    image

    响应headers

    image

  • chore(deps): bump json5 from 2.2.1 to 2.2.2

    chore(deps): bump json5 from 2.2.1 to 2.2.2

    Bumps json5 from 2.2.1 to 2.2.2.

    Release notes

    Sourced from json5's releases.

    v2.2.2

    • Fix: Properties with the name __proto__ are added to objects and arrays. (#199) This also fixes a prototype pollution vulnerability reported by Jonathan Gregson! (#295).
    Changelog

    Sourced from json5's changelog.

    v2.2.2 [code, diff]

    • Fix: Properties with the name __proto__ are added to objects and arrays. (#199) This also fixes a prototype pollution vulnerability reported by Jonathan Gregson! (#295).
    Commits
    • 14f8cb1 2.2.2
    • 10cc7ca docs: update CHANGELOG for v2.2.2
    • 7774c10 fix: add proto to objects and arrays
    • edde30a Readme: slight tweak to intro
    • 97286f8 Improve example in readme
    • d720b4f Improve readme (e.g. explain JSON5 better!) (#291)
    • 910ce25 docs: fix spelling of Aseem
    • 2aab4dd test: require tap as t in cli tests
    • 6d42686 test: remove mocha syntax from tests
    • 4798b9d docs: update installation and usage for modules
    • Additional commits viewable in compare view

    Dependabot compatibility score

    Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


    Dependabot commands and options

    You can trigger Dependabot actions by commenting on this PR:

    • @dependabot rebase will rebase this PR
    • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
    • @dependabot merge will merge this PR after your CI passes on it
    • @dependabot squash and merge will squash and merge this PR after your CI passes on it
    • @dependabot cancel merge will cancel a previously requested merge and block automerging
    • @dependabot reopen will reopen this PR if it is closed
    • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
    • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
    • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
    • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    • @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
    • @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
    • @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
    • @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

    You can disable automated security fix PRs for this repo from the Security Alerts page.

  • 替换或新增响应body里json里的某个值,可以用resMerge或者resReplace写吗?

    替换或新增响应body里json里的某个值,可以用resMerge或者resReplace写吗?

    响应json如下: { "code": 0, "message": "", "data": { "nickname": "a", "usernewno": "45666", "phone_no": "" } }

    只想替换data下的nickname为bbbbb,如何写呢,用resMerge或resReplace只能写到code那层级,无法改写到data里面的值,是书写规则不对吗?应该怎么写? 使用规则https://xxxxxxx resMerge://(nickname=a11),结果返回是: { "code": 0, "message": "", "data": { "nickname": "a", "usernewno": "1192381928", "phone_no": "" }, "nickname": "a11" }

  • chore(deps): bump express from 4.17.2 to 4.17.3

    chore(deps): bump express from 4.17.2 to 4.17.3

    Bumps express from 4.17.2 to 4.17.3.

    Release notes

    Sourced from express's releases.

    4.17.3

    Changelog

    Sourced from express's changelog.

    4.17.3 / 2022-02-16

    Commits

    Dependabot compatibility score

    Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


    Dependabot commands and options

    You can trigger Dependabot actions by commenting on this PR:

    • @dependabot rebase will rebase this PR
    • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
    • @dependabot merge will merge this PR after your CI passes on it
    • @dependabot squash and merge will squash and merge this PR after your CI passes on it
    • @dependabot cancel merge will cancel a previously requested merge and block automerging
    • @dependabot reopen will reopen this PR if it is closed
    • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
    • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
    • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
    • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    • @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
    • @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
    • @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
    • @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

    You can disable automated security fix PRs for this repo from the Security Alerts page.

  • 默认配置存在安全风险

    默认配置存在安全风险

    在当前https://www.npmjs.com/package/whistle、http://wproxy.org/whistle/install.html、Github Readme的安装和运行说明/教程中均为默认配置方案 该默认配置方案没有设置账号密码,存在安全风险 黑客在通过前置攻击进入同个网段后,可以直接扫描网络环境中开启whistle的服务,如以下banner信息中x-server: whistle可以作为指纹进行搜索,如https://www.zoomeye.org/searchResult?q=%22x-server%5C%3A%20whistle%22 可以找到在互联网上开放的相关服务 `HTTP/1.1 502 Bad Gateway content-type: text/html; charset=utf8 x-server: whistle Date: Thu, 01 Dec 2022 02:41:21 GMT Connection: close

    From: [email protected]
    Node: v16.15.0
    Host: 10_0_12_10
    Date: 2022/12/1 10:41:21
    Error: connect ECONNREFUSED 127.0.0.1:80
        at TCPConnectWrap.afterConnect [as oncomplete] (node:net:1187:16)
    
    
    Reload this page
    
    `

    由于没设置账号密码,黑客就可以盗取cookie,等于盗取其他用户身份,再进行下一步攻击(已在实际企业攻击演练中多次采用该方式绕过用户权限限制)

  • chore(deps): bump decode-uri-component from 0.2.0 to 0.2.2

    chore(deps): bump decode-uri-component from 0.2.0 to 0.2.2

    Bumps decode-uri-component from 0.2.0 to 0.2.2.

    Release notes

    Sourced from decode-uri-component's releases.

    v0.2.2

    • Prevent overwriting previously decoded tokens 980e0bf

    https://github.com/SamVerschueren/decode-uri-component/compare/v0.2.1...v0.2.2

    v0.2.1

    • Switch to GitHub workflows 76abc93
    • Fix issue where decode throws - fixes #6 746ca5d
    • Update license (#1) 486d7e2
    • Tidelift tasks a650457
    • Meta tweaks 66e1c28

    https://github.com/SamVerschueren/decode-uri-component/compare/v0.2.0...v0.2.1

    Commits

    Dependabot compatibility score

    Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


    Dependabot commands and options

    You can trigger Dependabot actions by commenting on this PR:

    • @dependabot rebase will rebase this PR
    • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
    • @dependabot merge will merge this PR after your CI passes on it
    • @dependabot squash and merge will squash and merge this PR after your CI passes on it
    • @dependabot cancel merge will cancel a previously requested merge and block automerging
    • @dependabot reopen will reopen this PR if it is closed
    • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
    • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
    • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
    • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    • @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
    • @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
    • @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
    • @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

    You can disable automated security fix PRs for this repo from the Security Alerts page.

Http-logging-proxy - A HTTP Logging Proxy For Golang

http-logging-proxy HTTP Logging Proxy Description This project builds a simple r

Aug 1, 2022
PlanB: a HTTP and websocket proxy backed by Redis and inspired by Hipache.

PlanB: a distributed HTTP and websocket proxy What Is It? PlanB is a HTTP and websocket proxy backed by Redis and inspired by Hipache. It aims to be f

Mar 20, 2022
Local Portable HTTP/HTTPS Proxy

SkelgoKey Portable Local Web Proxy - Creates a local proxy that bypasses any network certificate checks - USAGES Windows .\SkeletonKey.exe (web addres

Oct 13, 2021
Swiss Army knife Proxy tool for HTTP/HTTPS traffic capture, manipulation, and replay on the go.
Swiss Army knife Proxy tool for HTTP/HTTPS traffic capture, manipulation, and replay on the go.

Features • Installation • Usage • Running Proxify • Installing SSL Certificate • Applications of Proxify • Join Discord Swiss Army Knife Proxy for rap

Jan 8, 2023
Goproxy - HTTP/HTTPS Forward and Reverse Proxy

Go HTTP(s) Forward/Reverse Proxy This is intended to provide the proxy for the goproxy frontend. It is currently a work in progress, and is not very s

Jan 4, 2022
This is a tool that will proxy simple HTTPS requests to an external HTTP endpoint
 This is a tool that will proxy simple HTTPS requests to an external HTTP endpoint

AcmeShield A secured HTTP proxy that forwards requests from a remote service(Postman). This is a tool that will proxy simple HTTPS requests to an exte

Mar 21, 2022
Websockify-go - A reverse proxy that support tcp, http, https, and the most important, noVNC, which makes it a websockify

websockify-go | mproxy a reverse proxy that support tcp, http, https, and the mo

Aug 14, 2022
Simple HTTP/HTTPS proxy - designed to be distributed as a self-contained binary that can be dropped in anywhere and run.

Simple Proxy This is a simple HTTP/HTTPS proxy - designed to be distributed as a self-contained binary that can be dropped in anywhere and run. Code b

Jan 7, 2023
A simple tool to convert socket5 proxy protocol to http proxy protocol

Socket5 to HTTP 这是一个超简单的 Socket5 代理转换成 HTTP 代理的小工具。 如何安装? Golang 用户 # Required Go 1.17+ go install github.com/mritd/s2h@master Docker 用户 docker pull m

Jan 2, 2023
websocket proxy,简单的websocket反向代理实现,支持ws、wss
websocket proxy,简单的websocket反向代理实现,支持ws、wss

websocket proxy 100行代码实现轻量的websocket代理库,不依赖其他三方库,支持ws、wss代理 使用示例 Install go get github.com/pretty66/websocketproxy import ( "github.com/pretty66/w

Dec 27, 2022
Websocket proxy component
Websocket proxy component

Proxy server component Task description Task description is in DESCRIPTION.md Issues found in task description and fixed signal.Notify wasn't cathing

Dec 1, 2022
A suite of gRPC debugging tools. Like Fiddler/Charles but for gRPC.

grpc-tools A suite of tools for gRPC debugging and development. Like Fiddler/Charles but for gRPC! The main tool is grpc-dump which transparently inte

Dec 22, 2022
MOSN is a cloud native proxy for edge or service mesh. https://mosn.io
MOSN is a cloud native proxy for edge or service mesh. https://mosn.io

中文 MOSN is a network proxy written in Golang. It can be used as a cloud-native network data plane, providing services with the following proxy functio

Dec 30, 2022
inlets-connect is a proxy that supports HTTPS and the CONNECT method

inlets-connect inlets-connect is a proxy that supports HTTPS and the CONNECT method. It can be deployed as a side-car or stand-alone to proxy to a sin

Nov 7, 2022
Go-http-sleep: Delayed response http server, useful for testing various timeout issue for application running behind proxy

delayed response http server, useful for testing various timeout issue for application running behind proxy

Jan 22, 2022
开箱即用的基于命令的消息处理框架,让 websocket 和 tcp 开发就像 http 那样简单

Cmd Srv 开箱即用的基于命令的消息处理框架,让 websocket 和 tcp 开发就像 http 那样简单

Sep 25, 2022
NotifyTool - A message forwarding service for http to websocket

notifyTool this is a message forwarding service for http to websocket task webso

Jan 3, 2022
HTTP tunnel over Websocket
HTTP tunnel over Websocket

WS PROXY This is a reverse HTTP proxy over websockets. The aim is to securely make call to internal APIs from outside. How does it works a WSP client

Nov 12, 2022
TCP over HTTP/WebSocket

Introduction toh is tcp over http. short words: proxy your network over websocket Table of contents ToH server Caddy or Nginx wrap ToH server with TLS

May 6, 2023