Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
직접 명령은 검토 Prompt를 거치지 않습니다. 실행하기 전에 소스를 확인하세요.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill wstg-inpv-16명령은 한 줄로 유지됩니다. 복사하기 전에 가로로 스크롤해 전체 내용을 확인하세요.
로컬 사본을 원하시나요? SkillsMP에서 현재 제공할 수 있는 파일을 다운로드하세요.
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
SKILL.md 표시 중
SOC 직업 분류 기준
| name | wstg-inpv-16 |
| description | Testing for HTTP Incoming Requests |
| category | input-validation |
| owasp_id | WSTG-INPV-16 |
| version | 1.0.0 |
| author | cyberstrike-official |
| tags | ["injection","input-validation","xss","sqli","wstg","inpv"] |
| tech_stack | [] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
WSTG-INPV-16
Testing for HTTP Incoming Requests
This test examines how applications handle incoming HTTP requests, including unusual methods, oversized headers, malformed requests, and protocol-level attacks. Proper handling prevents denial of service, information disclosure, and bypass of security controls.
#!/bin/bash
TARGET="https://target.com"
echo "[*] Testing HTTP Incoming Request Handling..."
# Oversized header
curl -s -I "$TARGET" \
-H "X-Oversized: $(python3 -c 'print("A"*8000)')" 2>&1 | head -5
# Multiple same headers
curl -s -I "$TARGET" \
-H "X-Test: value1" \
-H "X-Test: value2" \
-H "X-Test: value3" | head -10
# Malformed HTTP version
echo -e "GET / HTTP/9.9\r\nHost: $TARGET\r\n\r\n" | nc -v $TARGET 80
# Long URI
curl -s "$TARGET/$(python3 -c 'print("A"*4000)')" 2>&1 | -5
#!/usr/bin/env python3
"""
HTTP Incoming Request Handler Tester
"""
import socket
import ssl
import time
from urllib.parse import urlparse
class HTTPRequestTester:
def __init__(self, url):
self.url = url
self.parsed = urlparse(url)
self.host = self.parsed.netloc.split(':')[0]
self.port = 443 if self.parsed.scheme == 'https' else 80
self.findings = []
def send_raw(self, data, timeout=10):
"""Send raw data to server"""
try:
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.settimeout(timeout)
if self.parsed.scheme == 'https':
context = ssl.create_default_context()
sock = context.wrap_socket(sock, server_hostname=self.host)
sock.connect((self.host, self.port))
sock.send(data.encode() if isinstance(data, str) else data)
response = b""
try:
while True:
chunk = sock.recv(4096)
if not chunk:
break
response += chunk
except socket.timeout:
pass
sock.close()
return response.decode('utf-8', errors='ignore')
except Exception as e:
return f"Error: {str(e)}"
def test_oversized_headers(self):
"""Test handling of oversized headers"""
print("\n[*] Testing oversized header handling...")
sizes = [1000, 4000, 8000, 16000, 32000]
for size in sizes:
header_value = "A" * size
request = f"""GET / HTTP/1.1\r
Host: {self.host}\r
X-Oversized: {header_value}\r
\r
"""
response = self.send_raw(request)
if 'HTTP/1.1 413' in response:
print(f" [OK] {size} bytes: 413 Request Entity Too Large")
elif 'HTTP/1.1 431' in response:
print(f" [OK] {size} bytes: 431 Request Header Fields Too Large")
elif 'HTTP/1.1 400' in response:
print(f" [OK] {size} bytes: 400 Bad Request")
elif 'HTTP/1.' in response:
print(f" [INFO] {size} bytes: Accepted")
else:
print(f" [WARN] {size} bytes: Unexpected response")
def test_long_uri(self):
"""Test handling of long URIs"""
print("\n[*] Testing long URI handling...")
sizes = [1000, 2000, 4000, 8000, 16000]
for size in sizes:
long_path = "/" + "A" * size
request = f"""GET {long_path} HTTP/1.1\r
Host: {self.host}\r
\r
"""
response = self.send_raw(request)
if 'HTTP/1.1 414' in response:
print(f" [OK] {size} char URI: 414 URI Too Long")
elif 'HTTP/1.1 400' in response:
print(f" [OK] {size} char URI: 400 Bad Request")
elif 'HTTP/1.' in response:
print(f" [INFO] {size} char URI: Accepted")
def test_malformed_requests(self):
"""Test handling of malformed requests"""
print("\n[*] Testing malformed request handling...")
malformed_requests = [
("GET / HTTP/9.9\r\nHost: {host}\r\n\r\n", "Invalid HTTP version"),
("INVALID / HTTP/1.1\r\nHost: {host}\r\n\r\n", "Invalid method"),
("GET /\r\nHost: {host}\r\n\r\n", "Missing HTTP version"),
("GET / HTTP/1.1\r\n\r\n", "Missing Host header"),
("GET / HTTP/1.1\r\nHost:\r\n\r\n", "Empty Host header"),
("GET HTTP/1.1\r\nHost: {host}\r\n\r\n", "Missing path"),
("\x00GET / HTTP/1.1\r\nHost: {host}\r\n\r\n", "Null byte prefix"),
]
for request_template, description in malformed_requests:
request = request_template.format(host=self.host)
response = self.send_raw(request)
if 'HTTP/1.1 400' in response or 'HTTP/1.1 505' in response:
print(f" [OK] {description}: Properly rejected")
elif 'HTTP/1.1 200' in response:
print(f" [WARN] {description}: Accepted (possible issue)")
self.findings.append({
'type': 'Malformed Request Accepted',
'description': description,
'severity': 'Low'
})
else:
print(f" [INFO] {description}: {response[:50]}")
def test_duplicate_headers(self):
"""Test handling of duplicate headers"""
print("\n[*] Testing duplicate header handling...")
# Multiple Host headers (potential smuggling vector)
request = f"""GET / HTTP/1.1\r
Host: {self.host}\r
Host: evil.com\r
\r
"""
response = self.send_raw(request)
print(f" Multiple Host headers: {'Rejected' if '400' in response else 'Accepted'}")
# Multiple Content-Length
request = f"""POST / HTTP/1.1\r
Host: {self.host}\r
Content-Length: 10\r
Content-Length: 20\r
\r
1234567890"""
response = self.send_raw(request)
if '400' in response:
print(f" [OK] Multiple Content-Length: Rejected")
else:
print(f" [WARN] Multiple Content-Length: Accepted")
self.findings.append({
'type': 'Duplicate Headers Accepted',
'header': 'Content-Length',
'severity': 'Medium'
})
def test_slow_request(self):
"""Test slow HTTP request handling (Slowloris-style)"""
print("\n[*] Testing slow request handling...")
try:
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.settimeout(60)
if self.parsed.scheme == 'https':
context = ssl.create_default_context()
sock = context.wrap_socket(sock, server_hostname=self.host)
sock.connect((self.host, self.port))
# Send partial request
sock.send(f"GET / HTTP/1.1\r\nHost: {self.host}\r\n".encode())
# Wait and send more
start_time = time.time()
for i in range(10):
time.sleep(2)
sock.send(b"X-Header: value\r\n")
elapsed = time.time() - start_time
if elapsed > 15:
print(f" [INFO] Connection maintained for {elapsed:.0f}s")
break
sock.close()
if elapsed > 10:
print(f" [WARN] Server allows slow requests (potential DoS)")
self.findings.append({
'type': 'Slow Request Allowed',
'duration': elapsed,
'severity': 'Medium'
})
except socket.timeout:
print(f" [OK] Connection timed out properly")
except Exception as e:
print(f" [INFO] {str(e)}")
def test_large_body(self):
"""Test large request body handling"""
print("\n[*] Testing large body handling...")
sizes = [(1024, "1KB"), (1024*1024, "1MB"), (10*1024*1024, "10MB")]
for size, label in sizes:
body = "A" * size
request = f"""POST / HTTP/1.1\r
Host: {self.host}\r
Content-Type: application/x-www-form-urlencoded\r
Content-Length: {len(body)}\r
\r
{body}"""
response = self.send_raw(request, timeout=30)
if '413' in response:
print(f" [OK] {label}: 413 Payload Too Large")
break
elif '400' in response or '500' in response:
print(f" [INFO] {label}: Rejected with error")
else:
print(f" [INFO] {label}: Accepted")
def generate_report(self):
"""Generate findings report"""
print("\n" + "="*60)
print("HTTP REQUEST HANDLING REPORT")
print("="*60)
if not self.findings:
print("\nNo significant issues found.")
else:
for f in self.findings:
print(f"\n[{f['severity']}] {f['type']}")
if 'description' in f:
print(f" Description: {f['description']}")
def run_tests(self):
"""Run all tests"""
self.test_oversized_headers()
self.test_long_uri()
self.test_malformed_requests()
self.test_duplicate_headers()
self.test_slow_request()
self.test_large_body()
self.generate_report()
# Usage
tester = HTTPRequestTester("https://target.com")
tester.run_tests()
| Tool | Purpose |
|---|---|
| curl | Basic testing |
| netcat | Raw request sending |
| slowhttptest | Slow HTTP DoS testing |
# Nginx - Request limits
client_max_body_size 10m;
client_header_buffer_size 1k;
large_client_header_buffers 4 8k;
client_body_timeout 10s;
client_header_timeout 10s;
# Apache - Request limits
LimitRequestBody 10485760
LimitRequestFields 100
LimitRequestFieldSize 8190
LimitRequestLine 8190
Timeout 60
| Finding | CVSS | Severity |
|---|---|---|
| No request size limits | 5.3 | Medium |
| Slow HTTP DoS possible | 5.3 | Medium |
| Malformed request acceptance | 4.3 | Medium |
| CWE ID | Title |
|---|---|
| CWE-400 | Uncontrolled Resource Consumption |
[ ] Oversized headers tested
[ ] Long URIs tested
[ ] Malformed requests tested
[ ] Duplicate headers tested
[ ] Slow requests tested
[ ] Large body tested
[ ] Findings documented