http-attack 0.0.0-stage → 1.0.1-rc.0

package/skills/http-attack/scripts/lib/http.mjs

@@ -0,0 +1,139 @@
+import { request } from 'node:http';
+import { connect } from 'node:net';
+
+export const is2xx = (s) => s >= 200 && s < 300;
+export const is4xx = (s) => s >= 400 && s < 500;
+export const is5xx = (s) => s >= 500;
+
+// A login page is a Location with a whole path segment that names one: /login, /accounts/sign-in, /auth/start. Segments are
+// compared whole, so /authors/3 and /processors are not login pages.
+const LOGIN_SEGMENTS = new Set(['login', 'log-in', 'log_in', 'logon', 'signin', 'sign-in', 'sign_in', 'sso', 'auth', 'authenticate']);
+export const isLoginLocation = (location) => {
+  if (!location) return false;
+  try {
+    return new URL(location, 'http://local').pathname.split('/').some((segment) => LOGIN_SEGMENTS.has(decodeURIComponent(segment).toLowerCase().replace(/\.[a-z]+$/, '')));
+  } catch { return false; }
+};
+
+// Access was granted: a 2xx, or a redirect that does not lead to a login page (a 303 to the created item is a grant).
+export const granted = (res) => is2xx(res.s) || (res.s >= 300 && res.s < 400 && !isLoginLocation(res.headers?.location));
+
+const BODY_CAP = 200_000;
+const REQUEST_TIMEOUT_MS = 10_000;
+const RAW_TIMEOUT_MS = 3000;
+const STREAM_TICK_MS = 5;
+
+const ID_SEGMENT = /\/(?:\d+|[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}|[0-9a-f]{12,})(?=\/|$)/gi;
+
+const ALWAYS_CREDENTIAL =['authorization', 'cookie', 'x-api-key'];
+
+const bareHost = (hostname) => hostname.replace(/^\[|\]$/g, '');
+
+// Everything that talks to the app. `base` is a URL; `opts` carries the credentials and the common-header list.
+export function createClient(base, opts) {
+  const host = bareHost(base.hostname);
+  const port = Number(base.port || 80);
+  const credentialNames = [...ALWAYS_CREDENTIAL, ...opts.authHeaderNames];
+  const withoutCredentials = (h) => Object.fromEntries(Object.entries(h).filter(([k]) => !credentialNames.includes(k)));
+  const misses = new Map(); // "METHOD path" => { headers, statuses }: responses that lack a common header
+
+  const noteHeaders = (method, path, status, headers) => {
+    const missing = opts.common.filter((h) => headers?.[h] === undefined);
+    if (!missing.length) return;
+    const key = `${method} ${path.split('?')[0]}`;
+    const entry = misses.get(key) ?? { method, path: path.split('?')[0], headers: new Set(), statuses: new Set() };
+    missing.forEach((h) => entry.headers.add(h));
+    entry.statuses.add(status);
+    misses.set(key, entry);
+  };
+
+  // The misses grouped by route, so one defect is one id however many ids the paths carried: a path that fits the item
+  // template is that template, else numeric, UUID and long hex segments become {id}.
+  const missesByRoute = (itemTemplate) => {
+    const fits = itemTemplate && new RegExp(`^${itemTemplate.split('?')[0].split(/\{[^}]*\}/).map((s) => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')).join('[^/]+')}$`);
+    const routeOf = ({ method, path }) => (fits?.test(path) ? `${method} ${itemTemplate.split('?')[0]}` : `${method} ${path.replace(ID_SEGMENT, '/{id}')}`);
+    const routes = new Map();
+    for (const entry of misses.values()) {
+      const route = routeOf(entry);
+      const group = routes.get(route) ?? { headers: new Set(), statuses: new Set() };
+      entry.headers.forEach((h) => group.headers.add(h));
+      entry.statuses.forEach((s) => group.statuses.add(s));
+      routes.set(route, group);
+    }
+    return routes;
+  };
+
+  // node:http, because fetch cannot send a path starting with // nor stream a slow body.
+  // auth: 'a' (the default headers), 'none' (credentials removed), 'b' (the other user's credentials),
+  // 'cookie' (only the session cookie, as a browser sends it: no token or API key header).
+  const send = (method, path, { body, type, headers = {}, auth = 'a', common = true } = {}) => new Promise((done) => {
+    const data = body === undefined ? null : Buffer.isBuffer(body) ? body : Buffer.from(body);
+    const cookie = opts.headers.cookie === undefined ? {} : { cookie: opts.headers.cookie };
+    const creds = auth === 'b' ? { ...withoutCredentials(opts.headers), ...opts.otherHeaders }
+      : auth === 'none' ? withoutCredentials(opts.headers)
+        : auth === 'cookie' ? { ...withoutCredentials(opts.headers), ...cookie } : opts.headers;
+    const all = { ...creds, ...(data ? { 'content-length': data.length, ...(type ? { 'content-type': type } : {}) } : {}), ...headers };
+    let settled = false;
+    const settle = (v) => { if (!settled) { settled = true; done(v); } };
+    let answered = false;
+    const req = request({ hostname: host, port, path, method, agent: false,
+      headers: Object.fromEntries(Object.entries(all).filter(([, v]) => v !== undefined)) }, (res) => {
+      answered = true;
+      let text = '';
+      res.setEncoding('utf8');
+      res.on('data', (d) => { if (text.length < BODY_CAP) text += d; });
+      const result = (extra) => ({ s: res.statusCode, headers: res.headers, text, ...extra });
+      res.on('end', () => { if (common) noteHeaders(method, path, res.statusCode, res.headers); settle(result()); });
+      // Headers sent, then the connection cut: the answer is the status that was seen, flagged incomplete.
+      res.on('aborted', () => settle(result({ truncated: true, err: 'ECONNRESET' })));
+      res.on('close', () => settle(result({ truncated: !res.complete, err: res.complete ? undefined : 'ECONNRESET' })));
+    });
+    req.setTimeout(REQUEST_TIMEOUT_MS, () => req.destroy(new Error('timeout')));
+    // Once the status line is in, a write error (EPIPE, ECONNRESET) is the server closing after answering early,
+    // as Node does for a request with "Connection: close": the response events decide the outcome.
+    req.on('error', (e) => answered || settle({ s: null, err: e.code ?? e.message, headers: {}, text: '' }));
+    req.end(data ?? undefined);
+  });
+
+  const alive = async () => (await send('GET', '/', { common: false })).s !== null;
+
+  // A body that keeps coming: a server without a limit or a timeout reads it forever.
+  const stream = (method, path, headers, total, pieceSize, { stopAfterMs, prefix }) => new Promise((done) => {
+    const req = request({ hostname: host, port, path, method, agent: false, headers: { ...opts.headers, ...headers } });
+    const piece = Buffer.alloc(pieceSize, 97);
+    const t0 = Date.now();
+    let sent = 0, over = false, timer;
+    const finish = (v) => { if (over) return; over = true; clearInterval(pump); clearTimeout(timer); req.destroy(); done({ ...v, sent, ms: Date.now() - t0 }); };
+    const pump = setInterval(() => {
+      if (sent >= total) { clearInterval(pump); timer = setTimeout(() => finish({ kind: 'silent' }), stopAfterMs); return; }
+      if (req.writableNeedDrain) return;
+      req.write(sent === 0 && prefix ? Buffer.concat([Buffer.from(prefix), piece]) : piece);
+      sent += piece.length;
+    }, STREAM_TICK_MS);
+    req.on('response', (res) => { res.resume(); finish({ kind: 'status', s: res.statusCode, headers: res.headers }); });
+    req.on('error', (e) => finish({ kind: 'closed', code: e.code ?? e.message }));
+    req.on('close', () => finish({ kind: 'closed', code: 'closed' }));
+  });
+
+  // Raw requests node:http refuses to send. Most servers answer them from the parser, before any middleware.
+  const raw = (payload) => new Promise((done) => {
+    const socket = connect({ host, port });
+    let data = Buffer.alloc(0), over = false;
+    const parse = (t) => {
+      const lines = t.split('\r\n');
+      const s = Number(lines[0].match(/^HTTP\/\d(?:\.\d)? (\d{3})/)?.[1]);
+      const headers = Object.fromEntries(lines.slice(1).filter((l) => l.includes(':'))
+        .map((l) => [l.slice(0, l.indexOf(':')).trim().toLowerCase(), l.slice(l.indexOf(':') + 1).trim()]));
+      return Number.isInteger(s) ? { kind: 'status', s, headers } : { kind: 'garbled', text: lines[0].slice(0, 40) };
+    };
+    const finish = (v) => { if (over) return; over = true; clearTimeout(timer); socket.destroy(); done(v); };
+    const timer = setTimeout(() => finish({ kind: 'silent' }), RAW_TIMEOUT_MS);
+    socket.on('connect', () => socket.write(payload));
+    socket.on('data', (d) => { data = Buffer.concat([data, d]); const i = data.indexOf('\r\n\r\n'); if (i >= 0) finish(parse(data.subarray(0, i).toString('latin1'))); });
+    socket.on('error', (e) => finish(data.length ? parse(data.toString('latin1')) : { kind: 'closed', code: e.code }));
+    socket.on('close', () => finish(data.length ? parse(data.toString('latin1')) : { kind: 'closed' }));
+  });
+
+  return { base, host, port, send, alive, stream, raw, misses, missesByRoute, withoutCredentials, noteHeaders,
+    hasCredentials: () => Object.keys(opts.headers).some((k) => credentialNames.includes(k)) };
+}

package/skills/http-attack/scripts/lib/probes/auth.mjs

@@ -0,0 +1,159 @@
+import { granted, is2xx } from '../http.mjs';
+import { wire } from '../body.mjs';
+
+const snippet = (text) => text.replace(/\s+/g, ' ').slice(0, 120);
+
+// Where a created item can be read back: the Location, else --item-path with the id from the JSON body.
+export function itemUrlOf(res, { base, itemPath }) {
+  if (res.headers.location) {
+    try { const u = new URL(res.headers.location, base); return u.pathname + u.search; } catch { /* not a URL: fall through */ }
+  }
+  if (!itemPath) return null;
+  try {
+    const j = JSON.parse(res.text);
+    const id = j?.id ?? j?.data?.id ?? j?.item?.id;
+    return id === undefined ? null : itemPath.replace('{id}', encodeURIComponent(id));
+  } catch { return null; }
+}
+
+// A stable label for an item URL: the id segment becomes {id}.
+// The last path segment is the id, with or without a trailing slash: /items/37, /items/37/, /api/v1/items/37.
+const withIdSegment = (url) => url.split('?')[0].replace(/[^/]+(\/?)$/, '{id}$1');
+const lastSegment = (url) => url.split('?')[0].split('/').filter(Boolean).pop();
+export const itemLabel = (url, template) => (template && url.startsWith(template.split('{id}')[0]) ? template : withIdSegment(url));
+
+// The id-less template of an item route, learned from a created item's Location when --item-path was not given.
+export const inferTemplate = (url, res) => {
+  const last = lastSegment(url);
+  let id;
+  try { id = JSON.parse(res.text)?.id; } catch { /* no JSON body */ }
+  return last && (id === undefined || decodeURIComponent(last) === String(id)) ? withIdSegment(url) : null;
+};
+
+// The legitimate create every other probe of this write depends on. { ok, res, item }.
+export async function legitWrite(run, w) {
+  const target = `${w.method} ${w.path}`;
+  const spec = { group: 'auth', probe: 'legit-write', target, name: `${target} legitimate request` };
+  const st = run.settings(w.method, w.path);
+  const p = wire(w, st);
+  if (p.error) { run.notRun(spec, p.error); return { ok: false }; }
+  const res = await run.client.send(w.method, w.path, { body: p.text, type: p.type });
+  if (await run.transportFault(res, spec, '2xx')) return { ok: false };
+  if (!granted(res)) {
+    run.notRun(spec, res.s >= 300
+      ? `the legitimate request was redirected to login (${res.headers.location}): the credentials do not work, so every other row of this write is unreliable`
+      : `the legitimate request answered ${res.s} (${snippet(res.text)}): every other row of this write is unreliable until it succeeds`);
+    return { ok: false, res };
+  }
+  run.pass(spec, res.s, '2xx');
+  return { ok: true, res, item: itemUrlOf(res, { base: run.client.base, itemPath: run.itemPath }) };
+}
+
+// A group of probes that all depend on a legitimate write that failed.
+export function notRunDependents(run, w, why) {
+  const target = `${w.method} ${w.path}`;
+  for (const [group, probe] of [['input', 'input-probes'], ['resources', 'resource-probes'], ['auth', 'access-probes'], ['csrf', 'csrf-probes']]) {
+    if (group === 'csrf' && !run.opts.csrf) continue;
+    run.notRun({ group, probe, target, name: `${target} ${probe}` }, `the legitimate request failed: ${why}`);
+  }
+}
+
+const unauthenticated = async (run, spec, method, path, expected, payload = {}) => {
+  const res = await run.client.send(method, path, { auth: 'none', ...payload });
+  if (await run.transportFault(res, spec, expected)) return;
+  if (granted(res)) run.fail('unauthenticated-access', spec, res.s, expected, res.s >= 300 ? `redirected to ${res.headers.location ?? '(no Location)'}, not to a login page` : undefined);
+  else run.pass(spec, res.s, expected);
+};
+
+// Authentication and object ownership on the item a legitimate write created.
+export async function accessProbes(run, w, legit) {
+  const { client, opts } = run;
+  const target = `${w.method} ${w.path}`;
+  const spec = (probe, name, t = target) => ({ group: 'auth', probe, target: t, name });
+  const st = run.settings(w.method, w.path);
+  const label = legit.item ? itemLabel(legit.item, run.itemTemplate) : null;
+
+  if (client.hasCredentials()) {
+    if (st.public) run.skipped(spec('write-without-credentials', `${target} without credentials`), 'the route is configured public');
+    else {
+      const p = wire(w, st);
+      await unauthenticated(run, spec('write-without-credentials', `${target} without credentials`), w.method, w.path, '401 (or a redirect to login)', { body: p.text, type: p.type });
+    }
+    if (legit.item) {
+      const itemSpec = spec('item-without-credentials', `GET ${label} without credentials`, `GET ${label}`);
+      if (run.settings('GET', legit.item).public) run.skipped(itemSpec, 'the item route is configured public');
+      else await unauthenticated(run, itemSpec, 'GET', legit.item, '401 (or a redirect to login)');
+    }
+  } else if (!run.state.noCredentialsReported) {
+    run.state.noCredentialsReported = true;
+    run.notRun(spec('no-credentials', 'authentication probes', '*'),
+      'no credentials were given (--header, --auth-env, --auth-header-name): the rows without credentials prove nothing. Suppress this row if the API is open by design');
+  }
+
+  const idor = spec('idor', `${target} ownership`);
+  if (!Object.keys(opts.otherHeaders).length) { run.notRun(idor, 'no credentials for user B (--other-header or --other-auth-env): the ownership probes were skipped'); return; }
+  if (!legit.item) { run.notRun(idor, `the create answered no Location${opts.itemPath || run.itemPath ? ' and its body has no id for --item-path' : ' and --item-path was not given'}`); return; }
+  const own = await client.send('GET', legit.item);
+  if (!is2xx(own.s)) { run.notRun(idor, `user A cannot read the item it created (${own.s ?? own.err}): the ownership probes would prove nothing`); return; }
+  const p = wire(w, st);
+  const bCreate = await client.send(w.method, w.path, { body: p.text, type: p.type, auth: 'b' });
+  const bItem = bCreate.s !== null && granted(bCreate) ? itemUrlOf(bCreate, { base: client.base, itemPath: run.itemPath }) : null;
+  const bOwn = bItem ? await client.send('GET', bItem, { auth: 'b' }) : null;
+  if (!bOwn || !is2xx(bOwn.s)) {
+    run.notRun(idor, `user B's credentials cannot create and read their own item (create ${bCreate.s ?? bCreate.err}${bOwn ? `, read ${bOwn.s}` : ''}): a 401/403 below would be a bad token, not ownership`);
+    return;
+  }
+  for (const m of ['GET', 'DELETE']) {
+    const s = spec(`idor-${m.toLowerCase()}`, `${m} ${label} as another user (IDOR / BOLA)`, `${m} ${label}`);
+    const r = await client.send(m, legit.item, { auth: 'b' });
+    const expected = '404 (or 403)';
+    if (await run.transportFault(r, s, expected)) continue;
+    if (!granted(r)) { run.pass(s, r.s, expected); continue; }
+    if (m === 'DELETE') {
+      // A 2xx proves nothing unless the object is gone: some routes answer 2xx to any method and delete nothing.
+      const after = await client.send('GET', legit.item);
+      if (is2xx(after.s)) { run.pass(s, r.s, expected, `answered ${r.s} but the item still exists: nothing was deleted`); continue; }
+    }
+    run.fail('idor', s, r.s, expected, "another user's credentials reach this object");
+  }
+}
+
+export async function readsWithoutCredentials(run) {
+  const { client, opts } = run;
+  if (!client.hasCredentials()) return;
+  for (const r of opts.reads) {
+    const spec = { group: 'auth', probe: 'read-without-credentials', target: `GET ${r.split('?')[0]}`, name: `GET ${r} without credentials` };
+    if (run.settings('GET', r).public) run.skipped(spec, 'the route is configured public');
+    else await unauthenticated(run, spec, 'GET', r, '401 (or a redirect to login)');
+  }
+}
+
+// Cookie-authenticated apps: a write from another origin must be refused (CSRF). "Same site" includes another port.
+export async function csrfProbes(run, w) {
+  const { client } = run;
+  const st = run.settings(w.method, w.path);
+  if (!Object.hasOwn(run.opts.headers, 'cookie')) {
+    run.notRun({ group: 'csrf', probe: 'cookie-required', target: `${w.method} ${w.path}`, name: `${w.method} ${w.path} CSRF probes` },
+      '--csrf tests cookie authentication and no Cookie header was given: a browser does not attach a Bearer token to a cross-site request. Pass the session cookie with --header "Cookie: ..."');
+    return;
+  }
+  const origins = [
+    ['another-site', 'from another site', { origin: 'https://attacker.example', 'sec-fetch-site': 'cross-site' }],
+    ['another-port', 'from another port of the same host', { origin: `http://${client.base.hostname}:${client.port + 1}`, 'sec-fetch-site': 'same-site' }],
+    ['null-origin', 'with Origin: null', { origin: 'null' }],
+  ];
+  for (const [tag, label, headers] of origins) {
+    const target = `${w.method} ${w.path}`;
+    const s = { group: 'csrf', probe: `origin-${tag}`, target, name: `${target} ${label}` };
+    const p = wire(w, st);
+    const attempt = () => client.send(w.method, w.path, { body: p.text, type: p.type, headers, auth: 'cookie' });
+    // A server that refuses early may reset the connection while the body is still being sent: one repeat before a drop is judged.
+    let r = await attempt();
+    if (r.s === null || r.truncated) r = await attempt();
+    const expected = '403 (any 4xx): the Origin is not this app';
+    if (await run.transportFault(r, s, expected)) continue;
+    if (granted(r)) run.fail('csrf', s, r.s, expected, r.s >= 300 ? `redirected to ${r.headers.location ?? '(no Location)'}: the write was accepted` : undefined);
+    else if (r.s === 409) run.notRun(s, 'answered 409: the body was refused before the origin check, so the check was not reached');
+    else run.pass(s, r.s, expected);
+  }
+}

package/skills/http-attack/scripts/lib/probes/fault.mjs

@@ -0,0 +1,61 @@
+import { spawnSync } from 'node:child_process';
+import { existsSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { wire } from '../body.mjs';
+import { leaksInternals } from '../run.mjs';
+
+const COMMAND_TIMEOUT_MS = 30_000;
+const RECOVERY_MS = 300;
+const SQLITE_BUSY_TIMEOUT_MS = 3000;
+
+// Experimental on some Node versions: the warning is not the user's concern.
+const importSqlite = async () => {
+  const emit = process.emitWarning;
+  process.emitWarning = (w, ...rest) => (String(w?.message ?? w).includes('SQLite') ? undefined : emit.call(process, w, ...rest));
+  try { return await import('node:sqlite'); } catch { return null; } finally { process.emitWarning = emit; }
+};
+
+const runShell = (command) => spawnSync(command, { shell: true, encoding: 'utf8', timeout: COMMAND_TIMEOUT_MS });
+
+// Fault injection: the database fails while a legitimate write arrives. Expected: one 5xx with the generic error body,
+// and the process stays up. Two injectors: an exclusive lock on a SQLite file, or any shell command with its restore.
+export async function faultProbe(run, w) {
+  const { client, opts } = run;
+  const how = opts.faultSqlite ? 'the SQLite file locked (BEGIN EXCLUSIVE)' : 'the configured fault command run'; // the command text can hold secrets: it stays out of reports
+  const target = w ? `${w.method} ${w.path}` : 'write';
+  const spec = { group: 'faults', probe: 'database-fault', target, name: `${target} with ${how}` };
+  const expected = '503 or 500 with the generic error body and the common headers; the process keeps answering';
+  if (!w) return run.notRun(spec, opts.writes.length ? 'no legitimate write succeeded: the fault probe sends one while the database is broken, so it has nothing to send' : 'a fault probe needs a --write');
+  const st = run.settings(w.method, w.path);
+
+  let release = () => {};
+  if (opts.faultSqlite) {
+    const sqlite = await importSqlite();
+    if (!sqlite) return run.notRun(spec, 'node:sqlite is not available (Node 22.13+)');
+    const file = resolve(opts.faultSqlite);
+    if (!existsSync(file)) return run.notRun(spec, `looked for the database at "${file}" (from "${opts.faultSqlite}") and it does not exist: pass the app the same absolute path`);
+    const db = new sqlite.DatabaseSync(file, { timeout: SQLITE_BUSY_TIMEOUT_MS });
+    try { db.exec('BEGIN EXCLUSIVE'); } catch (e) { db.close(); return run.notRun(spec, `could not lock the database: ${e.message}`); }
+    release = () => { try { db.exec('ROLLBACK'); } catch { /* the lock was already gone */ } db.close(); };
+  } else {
+    const started = runShell(opts.faultCmd);
+    if (started.status !== 0) {
+      if (opts.faultRestore) runShell(opts.faultRestore);
+      return run.notRun(spec, `faultCmd failed (${started.error?.code ?? `exit ${started.status}`}): ${(started.stderr || started.stdout || '').trim().slice(0, 200)}`);
+    }
+    release = () => {
+      if (!opts.faultRestore) return;
+      const restored = runShell(opts.faultRestore);
+      if (restored.status !== 0) process.stderr.write(`faultRestore failed (exit ${restored.status}): the fault may still be active.\n`);
+    };
+  }
+
+  let res;
+  try { const p = wire(w, st); res = await client.send(w.method, w.path, { body: p.text, type: p.type }); } finally { release(); }
+  await new Promise((r) => setTimeout(r, RECOVERY_MS));
+  if (!(await client.alive())) run.fail('process-died', spec, res.s ?? res.err, expected, 'the process died: an error from the database escaped a handler (unhandled rejection / uncaught exception)');
+  else if (res.s === null || res.truncated) run.fail('connection-dropped', spec, res.err, expected, 'the connection was dropped instead of an error response');
+  else if (res.s < 500) run.fail('fault-not-reported', spec, res.s, expected, 'a failed write was reported as something else');
+  else if (leaksInternals(res.text)) run.fail('stack-leak', spec, res.s, expected, 'the 5xx body leaks internals (stack, driver error)');
+  else run.pass(spec, res.s, expected);
+}

package/skills/http-attack/scripts/lib/probes/input.mjs

@@ -0,0 +1,104 @@
+import { granted } from '../http.mjs';
+import { caseVariant, isJsonBody, splitAtField, stringFields, withField, withValueAt, wire } from '../body.mjs';
+
+const MIB = 1 << 20;
+const ACCEPTED = (s) => s >= 200 && s < 400;
+
+// Malformed and hostile bodies on one write. Every skipped probe is a NOT RUN row.
+export async function malformedInput(run, w) {
+  const { client } = run;
+  const target = `${w.method} ${w.path}`;
+  const spec = (probe, name) => ({ group: 'input', probe, target, name: `${target} ${name}` });
+  const st = run.settings(w.method, w.path);
+  const json = isJsonBody(w);
+  const p = wire(w, st);
+  const type = p.type;
+  const send = (method, body, headers, t = type) => client.send(method, w.path, { body, type: t, headers });
+
+  // The answer must be a 4xx: a 5xx or a dropped connection is recorded as such, a 2xx/3xx as accepted input.
+  const mustRefuse = async (s, res, expected, rule = 'accepted-invalid') => {
+    if (await run.transportFault(res, s, expected)) return;
+    if (ACCEPTED(res.s)) run.fail(rule, s, res.s, expected);
+    else run.pass(s, res.s, expected);
+  };
+
+  if (json) {
+    await mustRefuse(spec('malformed-json', 'malformed JSON'), await send(w.method, '{"x":'), '400 with the error body');
+
+    const split = splitAtField(p);
+    const s = spec('invalid-utf8', 'invalid UTF-8 inside a string');
+    if (!split) run.notRun(s, 'the body has no string field to put the invalid bytes in');
+    else {
+      const bytes = Buffer.concat([Buffer.from(split[0]), Buffer.from([0xc3, 0x28, 0xff]), Buffer.from(split[1])]);
+      const res = await send(w.method, bytes);
+      if (st.invalidUtf8 === 'replace') {
+        if (!(await run.transportFault(res, s, 'any non-5xx: the route replaces invalid bytes with U+FFFD'))) run.pass(s, res.s, 'any non-5xx (invalidUtf8: replace)');
+      } else await mustRefuse(s, res, '400: strict UTF-8 decoding, nothing stored with U+FFFD (set invalidUtf8: "replace" for a route that replaces by design)');
+    }
+
+    const noType = spec('no-content-type', 'without a Content-Type');
+    const res = await client.send(w.method, w.path, { body: wire(w, st).text, headers: { 'content-type': undefined } });
+    if (!(await run.transportFault(res, noType, '415 (never a 5xx from reading a missing header)'))) run.pass(noType, res.s, '415 (never a 5xx from reading a missing header)');
+
+    const variantSpec = spec('media-type-variant', `${caseVariant(type)}`);
+    const variant = await send(w.method, wire(w, st).text, undefined, caseVariant(type));
+    if (!(await run.transportFault(variant, variantSpec, 'accepted: media types are case-insensitive and may carry parameters (RFC 9110 8.3.1)'))) {
+      if (variant.s === 415) run.fail('media-type-strict', variantSpec, 415, 'accepted: media types are case-insensitive and may carry parameters (RFC 9110 8.3.1)');
+      else run.pass(variantSpec, variant.s, 'accepted');
+    }
+
+    const fields = stringFields(wire(w, st));
+    if (!fields.length) run.notRun(spec('wrong-type', 'string field sent as another type'), 'the body has no string field to replace with another type');
+    for (const path of fields) {
+      const name = path.join('.');
+      for (const [label, tag, value] of [['a number', 'number', 1], ['null', 'null', null], ['an array', 'array', ['a']], ['an object', 'object', { a: 1 }]]) {
+        await mustRefuse(spec(`wrong-type-${tag}-${name}`, `"${name}" sent as ${label}`), await send(w.method, withValueAt(wire(w, st), path, value)), '400/422: wrong type, never coerced, never a 5xx');
+      }
+    }
+  } else run.notRun(spec('json-probes', 'JSON probes'), 'the write body is not JSON: malformed JSON, invalid UTF-8, media type and wrong-type probes need a JSON body');
+
+  // Only a 413 shows the limit works. A 400/422 is the validation of the field the probe padded: the limit was not tested.
+  // A server that answers early and closes can reset a large upload: the request is repeated once before a drop is judged.
+  // `makeBody` builds a new wire body (new unique values) for each attempt: a dropped attempt may already have been stored,
+  // and repeating it would answer 409 and hide the missing limit.
+  const limitVerdict = async (s, makeBody, expected, rule) => {
+    let res = await send(w.method, makeBody());
+    if (res.s === null || res.truncated) res = await send(w.method, makeBody());
+    if (await run.transportFault(res, s, expected)) return;
+    if (res.s === 413) run.pass(s, res.s, expected);
+    else if (granted(res)) run.fail(rule, s, res.s, expected, rule === 'limit-counts-characters' ? `${res.s} for a body over the limit` : undefined);
+    else run.notRun(s, `answered ${res.s}: the body was refused by validation (or another check) before a size limit, so the limit was not tested`);
+  };
+
+  const big = spec('body-1mb', '1 MB body');
+  if (st.bodyLimit && st.bodyLimit >= MIB) run.skipped(big, `bodyLimit ${st.bodyLimit} is at least 1 MB`);
+  else {
+    const makeBody = () => withField(wire(w, st), (v) => v + 'a'.repeat(MIB));
+    if (makeBody() === null) run.notRun(big, 'the body has no string field to pad to 1 MB');
+    else await limitVerdict(big, makeBody, '413, never stored and never a 5xx', 'no-body-limit');
+  }
+
+  const bytesProbe = spec('limit-counts-bytes', 'body 1+ byte over the limit made of multibyte characters');
+  const bigRow = run.rows.findLast((r) => r.probe === 'body-1mb' && r.target === target);
+  if (!json) { /* the JSON probes above already reported why */ }
+  else if (!st.bodyLimit) run.skipped(bytesProbe, 'no body limit configured (--body-limit or bodyLimit)');
+  else if (bigRow?.rule === 'no-body-limit') run.skipped(bytesProbe, 'the 1 MB body was accepted: there is no limit to count bytes against');
+  else {
+    const makeBody = () => {
+      const q = wire(w, st);
+      const rest = Buffer.byteLength(withField(q, () => '') ?? '');
+      return withField(q, () => 'é'.repeat(Math.floor((st.bodyLimit - rest) / 2) + 1));
+    };
+    if (makeBody() === null) run.notRun(bytesProbe, 'the body has no string field to pad with multibyte characters');
+    else await limitVerdict(bytesProbe, makeBody, '413: the limit counts bytes, not characters', 'limit-counts-characters');
+  }
+
+  for (const m of ['PUT', 'DELETE', 'PATCH'].filter((x) => x !== w.method)) {
+    const s = spec(`method-${m.toLowerCase()}`, `${m} (a method the route does not take)`);
+    const res = await send(m, wire(w, st).text);
+    if (await run.transportFault(res, s, '405 with Allow (or 404)')) continue;
+    if (ACCEPTED(res.s)) run.fail('accepted-invalid', s, res.s, '405 with Allow (or 404)');
+    else if (res.s === 405 && !res.headers.allow) run.fail('missing-allow', s, 405, '405 must name the allowed methods in Allow (RFC 9110 15.5.6)');
+    else run.pass(s, res.s, '405 with Allow (or 404)');
+  }
+}

package/skills/http-attack/scripts/lib/probes/parser.mjs

@@ -0,0 +1,36 @@
+import { is4xx, is5xx } from '../http.mjs';
+
+const DEFAULT_HEADER_BYTES = 20 << 10;
+const HEADER_SLACK = 1024;
+
+// Raw requests node:http refuses to send. Node, uvicorn, Go and most frameworks answer these from the parser, before any
+// middleware: the app's common headers (request id, CORS, cache, security headers) are missing unless the parser error is handled.
+export async function parserProbes(run, { writes }) {
+  const { client, opts } = run;
+  const host = client.base.host;
+  const bigHeader = (run.settings('GET', '/').maxHeaderBytes ?? DEFAULT_HEADER_BYTES - HEADER_SLACK) + HEADER_SLACK;
+  const smuggleTarget = writes[0]?.path ?? '/';
+  const RAW = [
+    ['garbage-request-line', 'GARBAGE request line', 'GARBAGE\r\n\r\n', '400', false],
+    ['non-ascii-path', 'non-ASCII bytes in the request path', Buffer.from(`GET /ñandú HTTP/1.1\r\nHost: ${host}\r\nConnection: close\r\n\r\n`, 'utf8'), 'any non-5xx (a 2xx is fine for a catch-all route)', true],
+    ['big-header', `${Math.round(bigHeader / 1024)} KB header`, `GET / HTTP/1.1\r\nHost: ${host}\r\nConnection: close\r\nX-Big: ${'a'.repeat(bigHeader)}\r\n\r\n`, '431', false],
+    ['cl-te-conflict', 'conflicting Content-Length and Transfer-Encoding', `POST ${smuggleTarget} HTTP/1.1\r\nHost: ${host}\r\nContent-Length: 4\r\nTransfer-Encoding: chunked\r\nConnection: close\r\n\r\n0\r\n\r\n`, '400 (request smuggling guard)', false],
+  ];
+  for (const [probe, what, payload, want, anyOk] of RAW) {
+    const spec = { group: 'parser', probe, target: 'raw', name: `raw: ${what}` };
+    const v = await client.raw(payload);
+    const expected = `${want} with the common headers, then the connection closes`;
+    if (!(await client.alive())) { run.fail('process-died', spec, v.s ?? v.kind, expected, 'the app stopped answering'); continue; }
+    if (v.kind === 'closed') { run.pass(spec, 'closed', expected); continue; }
+    if (v.kind !== 'status') { run.fail('parser-accepted', spec, v.kind, expected, v.text ?? 'no answer and no close in 3 s'); continue; }
+    if (is5xx(v.s)) { run.fail('server-error', spec, v.s, expected); continue; }
+    if (!is4xx(v.s)) {
+      if (anyOk) run.pass(spec, v.s, expected);
+      else run.fail('parser-accepted', spec, v.s, expected, probe === 'big-header' ? `the header limit is above ${Math.round(bigHeader / 1024)} KB: set maxHeaderBytes to the app's limit` : undefined);
+      continue;
+    }
+    const missing = opts.common.filter((h) => v.headers[h] === undefined);
+    if (missing.length && !opts.rawExempt) run.fail('parser-no-common-headers', spec, v.s, expected, `the parser's answer lacks ${missing.join(', ')}: the error is answered before the app's middleware`);
+    else run.pass(spec, v.s, expected, missing.length ? `common headers exempt: ${opts.rawExempt}` : undefined);
+  }
+}

package/skills/http-attack/scripts/lib/probes/paths.mjs

@@ -0,0 +1,83 @@
+import { is2xx } from '../http.mjs';
+
+const HUGE = ['9'.repeat(30), '-' + '9'.repeat(30), '1e3', ''];
+// Broken percent-encoding in the path is probed separately (`/%`), so it is not repeated here.
+const PATH_PARAMS = [['huge-number', '9'.repeat(30)], ['negative', '-1'], ['letters', 'abc'], ['invalid-uuid', 'not-a-uuid']];
+
+// Marker, regexp pairs: a hit on a 2xx that is not an HTML page means the file came back.
+const LEAKS = [
+  ['/.git/config', /\[core\]/], ['/.env', /^[A-Z][A-Z0-9_]*=/m], ['/package.json', /"(dependencies|scripts)"\s*:/],
+  ['/../../etc/passwd', /root:.*:0:0:/], ['/%2e%2e/%2e%2e/etc/passwd', /root:.*:0:0:/],
+  ['/..%5c..%5cwindows/win.ini', /\[fonts\]|for 16-bit app support/i],
+];
+
+// Digits and long hex/uuid runs vary between two responses of the same route; compare without them.
+const shape = (text) => text.replace(/[0-9a-f-]{8,}|\d+/gi, '#');
+
+export async function pathProbes(run, { writes, itemTemplate }) {
+  const { client, opts } = run;
+  const routes = [...new Set(['/', ...writes.map((w) => w.path), ...opts.reads])];
+  const spec = (probe, target, name) => ({ group: 'paths', probe, target, name });
+  const noFiveHundred = async (probe, target, name, path, expected) => {
+    const s = spec(probe, target, name);
+    const res = await client.send('GET', path);
+    if (!(await run.transportFault(res, s, expected))) run.pass(s, res.s, expected);
+  };
+
+  const seenPaths = new Set(); // path-level probes run once per path; the query only matters for the query-level ones
+  for (const r of routes) {
+    const [p, q] = r.split('?');
+    if (!seenPaths.has(p)) {
+      seenPaths.add(p);
+      const pathTarget = `GET ${p}`;
+      const s = spec('double-slash', pathTarget, `GET /${p} (double slash)`);
+      const [slash, plain] = [await client.send('GET', '/' + p), await client.send('GET', p)];
+      if (!(await run.transportFault(slash, s, 'a 4xx or the same resource, never a 5xx: "//x" is a path, not a host'))) {
+        if (is2xx(slash.s) && (slash.s !== plain.s || shape(slash.text) !== shape(plain.text))) {
+          run.fail('double-slash-mismatch', s, slash.s, `the same answer as ${p} (${plain.s}) or a 4xx`, `//${p.slice(1)} answered something else than ${p}: it is likely parsed as a host`);
+        } else run.pass(s, slash.s, 'a 4xx or the same resource');
+      }
+      const base = p.replace(/\/$/, '');
+      await noFiveHundred('percent-path', pathTarget, `GET ${base}/% (broken percent-encoding in the path)`, `${base}/%`, '400 or 404, never a 5xx');
+    }
+    const target = `GET ${r}`;
+    await noFiveHundred('percent-query', target, `GET ${p}?pct=%FF% (broken percent-encoding in the query)`, `${p}?${q ? `${q}&` : ''}pct=%FF%`, '400, never a 5xx');
+    for (const [k] of [...new URLSearchParams(q ?? '')].filter(([, v]) => /^-?\d+$/.test(v))) {
+      for (const huge of HUGE) {
+        const sp = new URLSearchParams(q); sp.set(k, huge);
+        await noFiveHundred(`number-${k}-${huge.slice(0, 6) || 'empty'}`, target, `GET ${p}?${k}=${huge.slice(0, 6) || '(empty)'} (number the parser cannot hold)`, `${p}?${sp}`, '400 or a clamped 2xx, never a 5xx');
+      }
+    }
+  }
+
+  if (itemTemplate) {
+    for (const [tag, value] of PATH_PARAMS) {
+      await noFiveHundred(`path-param-${tag}`, `GET ${itemTemplate}`, `GET ${itemTemplate.replace('{id}', value)} (path parameter)`, itemTemplate.replace('{id}', value), '400 or 404, never a 5xx');
+    }
+  } else {
+    run.notRun(spec('path-params', 'GET {item}', 'path parameter probes (huge number, letters, invalid UUID)'),
+      'no item route is known: pass --item-path "/items/{id}" or have the create answer a Location');
+  }
+
+  const readable = [...new Set(opts.reads.map((x) => x.split('?')[0]))];
+  const all = [...new Set([...writes.map((w) => w.path), ...readable])];
+  for (const r of all) for (const m of ['HEAD', 'OPTIONS']) {
+    if (m === 'HEAD' && !readable.includes(r)) continue;
+    const s = spec(m.toLowerCase(), `${m} ${r}`, `${m} ${r}`);
+    const res = await client.send(m, r);
+    const expected = '2xx, or 405 with Allow';
+    if (await run.transportFault(res, s, expected)) continue;
+    // Both findings can apply to one answer: HEAD refused, and without an Allow header.
+    if (res.s === 405 && m === 'HEAD') run.fail('head-unsupported', s, 405, 'HEAD answered like GET without the body (RFC 9110 9.1)');
+    if (res.s === 405 && !res.headers.allow) run.fail('missing-allow', s, 405, '405 must name the allowed methods in Allow (RFC 9110 15.5.6)');
+    if (res.s !== 405 || (m === 'OPTIONS' && res.headers.allow)) run.pass(s, res.s, expected);
+  }
+
+  for (const [p, marker] of LEAKS) {
+    const s = spec('file-served', `GET ${p}`, `GET ${p} (file the app must not serve)`);
+    const res = await client.send('GET', p, { common: false });
+    if (await run.transportFault(res, s, '404')) continue;
+    if (is2xx(res.s) && !/^\s*<(!doctype|html)/i.test(res.text) && marker.test(res.text)) run.fail('file-served', s, res.s, '404', 'the file content came back');
+    else run.pass(s, res.s, '404 (an SPA index page is fine)');
+  }
+}