HN Explorer

70 comments

[ 4.8 ms ] story [ 139 ms ] thread
3xblah
Don't forget socat.

Or tcpserver from djb

.

forgotmypw
How many of these can output a "standard" access log?

Instructions for how to do that would be a helpful addition to this page.

kragen
The Python one does.
beizhia
The Crystal version can. I just commented an update for it that will run on 0.32.1, but for logging you can include the HTTP::LogHandler:

  crystal eval 'require "http/server"; server = HTTP::Server.new([HTTP::LogHandler.new, HTTP::StaticFileHandler.new(".")]); server.bind_tcp(8080); server.listen'
fyp
Some of these aren't one line but could be (for example the one for node.js can use npx instead)
kragen
I was pleased and surprised that the Python 3 one works with Termux on this cellphone. I've had trouble with Python socket stuff on here in the past, but now I suspect that may have been specific to IP multicast.
slim
The busybox one works too
londons_explore
Lots of people use these one liners for Dev/test environments.

Most of those people aren't aware how insecure they are.

For example, with the python SimpleHTTPServer I can simply request http://localhost/../../.ssh/id_rsa

All your SSH private keys are now mine. I can steal your browser cookie database and get into your email/Facebook/Twitter in the same way.

Any web page can request that, or any software on any machine on your local network.

Thorrez
Huh? When I use SimpleHTTPServer with .. it just ignores the .. and keeps me in the same directory. Is the behavior different on different versions of python or something? Is there some special technique I don't know? I tried with '.' and with '%2e' .
tyingq
I noticed that browsers and curl were doing something with .. on the client side. Try telnet to the port and typing the GET by hand.
Thorrez
You're partially right that curl is blocking '..'. But it's not blocking '%2e%2e'. I got it to avoid blocking '..' with the --path-as-is flag.

I redid the tests, with curl's --path-as-is flag, as well as with raw TCP (via netcat), and SimpleHTTPServer is still not vulnerable.

guessmyname
> For example, with the python SimpleHTTPServer I can simply request http://localhost/../../.ssh/id_rsa

Eh! That’s not true. I just tried and both Python 2.7.16 and Python 3.7.6 return a "404 Not Found” when I try to download and existing file that is located one or more levels up from the directory where the HTTP server was started. Here is a screenshot showing both results: https://i.imgur.com/uizp7zV.png

londons_explore
Maybe behaviour has changed recently? In a past version someone has demonstrated this attack on me...
reificator
Were you perhaps running from your home directory?

Did the directory you were serving contain any symbolic links to folders outside of that directory?

_pmf_
> For example, with the python SimpleHTTPServer I can simply request http://localhost/../../.ssh/id_rsa

I think my localhost is different from your localhost.

allendoerfer
OP was suggesting that a website you were visiting was accessing this URL via JavaScript and posting it to OP's server.
minitech
Same-origin policy prevents that specific attack, although the same idea exists if you’re not protected from DNS rebinding on localhost, and `--bind 127.0.0.1` (or some other way to block the port) is necessary – but the Pythons’ built-in HTTP servers aren’t vulnerable to path traversal anyway.
[deleted]
(comment deleted)
[deleted]
(comment deleted)
scanr
Asked for an HTTPS one liner on stackoverflow a while back and got this answer:

    ruby -r webrick/https -e '
      WEBrick::HTTPServer.new(
        Port: 8000, DocumentRoot: ".",
        SSLEnable: true, SSLCertName: [%w[CN localhost]]).start'
https://stackoverflow.com/a/37986354/59325
avip
Caddy is brilliant for this task.
divbzero
For reference the HTTPS one-liner with Caddy [1] would be:

    caddy file-server --domain example.com
And similarly for HTTPS reverse proxy:

    caddy reverse-proxy --from example.com --to localhost:9000
[1]: https://caddyserver.com/

This plus hosts file can be a quick way to test secure cookies, secure headers, etc.

rjeli
You could also tunnel any of the http servers through socat ssl-l.
Ded7xSEoPKYNsDd
openssl can also do it. no dirlisting though.

    openssl req -x509 -newkey rsa:4096 -keyout /tmp/key.pem -out /tmp/cert.pem -nodes && openssl s_server -WWW -port 8443 -cert /tmp/cert.pem -key /tmp/key.pem
inconshreveable
It's missing my personal favorite:

ngrok http file:///Users/alan/share

capableweb
You might want to include a disclaimer that you're the author, maintainer and person behind the company that operates ngrok ;)

Just wanted to chime in and say I love ngrok too, not allow allows you to easily create proxies, it allows you to create proxies that also works on the public internet (ngrok assigns you a x.ngrok.io address) and with tcp connections. Great work on it inconshreveable!

arendtio
Does someone know if there is a way of doing this purely with POSIX tools?
arminiusreturns 

  while TRUE; do { echo -e 'HTTP/1.1 200 OK\r\n'; cat /path/to/thing; } | nc -l 8000; done
From: https://krypted.com/
ainar-g
Neither echo -e nor nc are POSIX. I don't think there is a strictly POSIX one-liner.
ksherlock
printf(1) is POSIX and is a superset of echo.
nickcw
There is of course rclone: https://rclone.org/commands/rclone_serve_http/

    rclone serve http .
You can replace . with any of your other cloud storage backends too (s3, google drive, dropbox, etc), or http with sftp, webdav, ftp, dlna. It works on Windos/macOS/Linux.

(Rclone author ;-)

kaendfinger
rclone is our backup solution at work, huge props to you!
tiltrus
Rclone is a fantastic tool. Thanks!
sondr3
Using `nix` I have an alias called `serve` that runs `nix run nixpkgs.caddy -c caddy -host 0.0.0.0 -port 8000 browse` which will download Caddy if it is not in my cache and then run it. It's one of my favorite aliases and I use it way more frequently than I'd expect.
tyingq
I'm pushing the definition of "one liner" here, and it's got some major shortcomings (including directory traversal!), but here's one with Gnu awk:

  gawk '@load "filefuncs";func send(s,e,d,t,b) {;print "HTTP/1.0 "s" "e|&S;print "Content-Length: "b|&S;print"Content-Type: "t|&S;print d|&S;close(S);}func mt(f) {;c = "file -b --mime-type " f;r="";while ((c|getline z)>0) {;r=r z;}  ;close(c);return r;} ;BEGIN {RS=ORS="\r\n";while(1){;S="/inet/tcp/8080/0/0";while((S|&getline l)>0) {;split(l,f," ");if(f[1]=="GET"){p=substr(f[2],2)}if(p==""){p="index.html"}stat(p,s);if (s["type"]=="file") {;m=mt(p);while ((getline i <p)>0){o=o i}send(200,"OK",o,m,s["size"]);break;} ;n="<html>Not Found</html>";send(404,"Not Found",n,"text/html",length(n));break;}}}'
edit: Added better mime-type detection and 404s. It actually sorta works well now.
tyingq
Oof. It wasn't handling binary files. Also fixed directory traversal, and you can optionally specify a content directory on the cmd line.

  gawk '@load"filefuncs";@load"readfile";func send(s,e,d,t,b){print"HTTP/1.0 "s" "e|&S;print"Content-Length: "b|&S;print"Content-Type: "t|&S;print d|&S;close(S);}func cf(x){split(x,y,"/");for(z in y){print "FOUND "y[z];if(y[z]==".."){return 0;}}return 1;}func mt(f){c="file -b --mime-type "f;r="";while((c|getline z)>0){r=r z;}close(c);return r;}BEGIN{if(ARGV[1]!=""){if(chdir(ARGV[1])){print "Failed to chdir to "ARGV[1];exit;}ARGC=1;}RS=ORS="\r\n";while(1){S="/inet/tcp/8080/0/0";while((S|&getline l)>0){split(l,f," ");if(f[1]=="GET"){p=substr(f[2],2)}if(p==""){p="index.html"}stat(p,s);if(cf(p)&&s["type"]=="file"){m=mt(p);o=readfile(p);send(200,"OK",o,m,s["size"]);break;}n="<html>Not Found</html>";send(404,"Not Found",n,"text/html"RS,length(n));break;}}}'
jmull
I've been using this:

    npx serve
(This is a node.js thing.)
runarberg
Unlike `python3 -m http.server`, `npx serve` doesn’t redirect `/path/to/dir` to `/path/to/dir/`. This is a problem if you are using relative paths in your `/path/to/dir/index.html`.
jmull
For my purposes that hasn’t been a problem.

I guess I would normally just start with ‘path/to/dir/‘ or ‘/path/to/dir/index.html’

laurent123456
I'm surprised there's no one-liner for Node without dependency since it has a server by default.

Edit: Didn't know there was an `eval` flag for Node, so that will do the job:

node --eval "var fs = require('fs'), http = require('http'); http.createServer(function (req, res) { fs.readFile(__dirname + req.url, function (err,data) { if (err) { res.writeHead(404); res.end(JSON.stringify(err)); return;}res.writeHead(200);res.end(data); });}).listen(8080);"

hombre_fatal
Doesn't protect against folder climbing/traversal like `curl :8080/../../etc`.
djsumdog
Huh .. that'd be a fun post; see how many of these can be susceptible for climbing out of their web root. The author does list which ones support dir indexes.
pvillano
hopefully you're not using a one-liner for your actual deployment. I use it for no stakes development
hombre_fatal
Caddy is a one-liner. Plenty of the one-liners are suitable for production. There are so many solutions that you might as well use one, even in development, that doesn't have such glaring issues, because you're basically training your muscle memory to reach for it.
laurent123456
Most of these one-liner probably aren't secure. As the title post says "Use this power wisely".
teknopaul
My favourite...

    apt install nginx
Why settle for less.
vorticalbox
If you use npx http-server -p 8080

You don't need to fully install globally

acidx
Lwan (https://lwan.ws) can also be used like this, although I wouldn't call it a "one liner" like many of the examples listed there:

    lwan -r /path/to/files/to/serve
[deleted]
(comment deleted)