[Owasp-turkey] kendime ait olmayan ip den /x? sayfasına http request yapabilir miyim?

özer göker ozergoker at gmail.com
Fri May 11 07:56:31 UTC 2012

WBox HTTP testing tool

Wbox aims to help you having fun while testing HTTP related stuff. You can
use it to perform many tasks, including the following.

   - Benchmarking how much time it takes to generate content for your web
   - Web server and web application stressing.
   - Testing virtual domains configuration without the need to alter your
   local resolver.
   - Check if your redirects are working correctly emitting the right HTTP
   - Test if the HTTP compression is working and if it is actually serving
   pages faster.
   - Use it as a *configuration-less HTTP server* to share files! (see the
   server mode documentation at the end of the Wbox tutorial in this page, but
   it's as simple as *% wbox servermode webroot /tmp*)

Wbox is *free software* under the BSD license and was written in ANSI C
(POSIX runtime required) by Salvatore 'antirez' Sanfilippo<http://invece.org>.

Wbox tutorial HTTP client mode

The following is a short tutorial. Wbox is trivial to use but you may want
to read this in order to understand better what wbox is and how to use it.
Basic usage The simplest way to use wbox is to call it with just one
argument, an url:

% *wbox www.google.it*
WBOX www.google.it ( port 80
0. 200 OK    3774 bytes    407 ms
1. 200 OK    (3767) bytes    273 ms
2. 200 OK    3767 bytes    304 ms
3. 200 OK    3767 bytes    260 ms
user terminated

As you can see wbox in this mode of operation resembles the ping
For every performed HTTP request it shows the sequence number of the
request (*0.*), the HTTP reply code and reason string (*200 OK*), the
number of bytes received from the server (*3774 bytes*), and the time the
request took to complete in milliseconds (*407 ms*). There are two details
to note.

   - The number of received bytes includes the HTTP reply header, so it is
   not equal to the document length.
   - Every time it changes compared to the previous HTTP reply, the number
   of received bytes is put between parens, like in *(3767)*

Limiting the number of requests By default wbox will continue to perform
requests forever, until you don't press Ctrl+C. After the url argument you
can pass a number of options to wbox to alter its behaviour, one of this is
an integer number specifying how many requests to perform.

% *wbox www.google.it/notexistingpage.html 1*
WBOX www.google.it ( port 80
0. 404 Not Found    1495 bytes    310 ms

This time wbox terminated after the first request was received. Obtaining
splitted timing information Usually web applications don't spend the same
time in the generation of every part of the page. With wbox it's possible
to obtain time information for different parts of the document using the *
timesplit* option.

% *wbox digg.com timesplit 1*
WBOX digg.com ( port 80
0. 200 OK    44134 bytes    1326 ms
       [0] 0-4095 -> 728 ms
       [1] 4096-8191 -> 254 ms
       [2] 8192-12287 -> 16 ms
       [3] 12288-16383 -> 17 ms
       [4] 16384-20479 -> 225 ms
       [5] 20480-24575 -> 12 ms
       [6] 24576-28671 -> 16 ms
       [7] 28672-32767 -> 18 ms
       [8] 32768-36863 -> 16 ms
       [9] 36864-40959 -> 16 ms
       [10] 40960-44133 -> 8 ms

Dumping data We may like to see what kind of HTTP reply google is emitting
on 404 errors, the option *showhdr* tells wbox to dump the HTTP reply

% *wbox www.google.it/notexistingpage.html 1 showhdr*
WBOX www.google.it ( port 80

HTTP/1.1 404 Not Found
Content-Type: text/html
Server: GWS/2.1
Content-Length: 1368
Date: Tue, 05 Jun 2007 16:49:58 GMT

0. 404 Not Found    1495 bytes    540 ms

We may like to use wbox inside a shell script in order to collect different
headers, so the option *silent* tells wbox to don't show status lines.

% *wbox www.google.it/notexistingpage.html 1 showhdr silent*
HTTP/1.1 404 Not Found
Content-Type: text/html
Server: GWS/2.1
Content-Length: 1368
Date: Tue, 05 Jun 2007 16:51:52 GMT

It's also possible to dump the whole reply using the *dump* option.

% *wbox www.google.it/notexistingpage.html 1 dump silent*
HTTP/1.1 404 Not Found
Content-Type: text/html
Server: GWS/2.1
Content-Length: 1368
Date: Tue, 05 Jun 2007 16:53:44 GMT

<meta http-equiv="content-type" content="text/html;charset=utf-8">
<title>404 Not Found</title>
body {font-family: arial,sans-serif}
div.nav {margin-top: 1ex}*(a lot of data omitted)*

You can use *dump* and *timesplit* at the same time in order to get a dump
of the reply with time annotations, but *warning!* using this feature the
time used in order to produce the actual output on screen will alter the
results, so you *must* redirect the output into a file. The right command
line to use is the following:

% *wbox http://digg.com dump timesplit 1 > /tmp/dump.txt*

Then open the file with an editor to see the HTTP reply splitted in chunks
of data separated by time annotations. Stressing servers and apps Instead
to make a single request it's possible to make multiple concurrent requests
using the *clients number* option. Wbox will spawn the required number of
processes, and every process will perform a query every second.

% *wbox http://localhost clients 4*
WBOX localhost ( port 80
0. 200 OK    9939 bytes    14 ms
0. 200 OK    9939 bytes    22 ms
0. 200 OK    9939 bytes    26 ms
0. 200 OK    9939 bytes    31 ms
1. 200 OK    9939 bytes    4 ms
1. 200 OK    9939 bytes    7 ms
1. 200 OK    9939 bytes    7 ms
1. 200 OK    9939 bytes    4 ms
2. 200 OK    9939 bytes    4 ms
2. 200 OK    9939 bytes    6 ms
2. 200 OK    9939 bytes    10 ms
2. 200 OK    9939 bytes    3 ms
3. 200 OK    9939 bytes    3 ms
3. 200 OK    9939 bytes    4 ms
3. 200 OK    9939 bytes    7 ms
3. 200 OK    9939 bytes    7 ms
user terminated

Every client will print a status line, so you can get an idea about delays
under load. Note that's much better to perform this tests on localhost or
over LAN in order to filter bandwidth limits that may otherwise alter the
numbers. Modifing requests period By default wbox will perform a request
per second, you can change this using the option *wait seconds* (for every
process). Set it to zero in order to perform continuous requests without
delay between them using *wait 0*. Setting cookies and referer Many web
applications perform different tasks for the same url if some cookie is set
to the right value. One obvious example is a login cookie. Wbox is able to
perform requests containing cookies using the option *cookie name
value*like in the following example.

% *wbox hping.org cookie secret ff8a45a7*

It is possible to use the *cookie* option multiple times to set more than a
cookie. Another parameter that sometimes may change the target site
behaviour is the Referer header. It is possbile to set it using the *referer
url* option. Testing virtual domains Sometimes after you configured a new
virtual domain in your web server it's handly to check if everything is
working as it should before DNS propagation and without the need to alter
by hand your /etc/hosts. You can use the *host name* wbox option in order
to do this.

% *wbox host www.google.it dump*
WBOX www.google.it ( port 80
HTTP/1.1 200 OK
Cache-Control: private
Content-Type: text/html; charset=UTF-8
Set-Cookie: PREF=ID=81ccf41f3364e7fa:TM=1181063780:LM=1181063780:S=yd7lfPo-SBZTngH_;
expires=Sun, 17-Jan-2038 19:14:07 GMT; path=/; domain=.google.it
Server: GWS/2.1
Transfer-Encoding: chunked
Date: Tue, 05 Jun 2007 17:16:20 GMT

<html>... (data omitted)

Testing HTTP compression Using the *compr* option wbox will include the
right headers to accept the gzip/deflate data encoding. If the web server
supports compression it will reply with compressed data, and wbox will show
this fact in the reply status lines.

% *wbox antirez.com compr*
WBOX antirez.com ( port 80 [compr]
0. 200 OK    6553 bytes    837 ms    compr
1. 200 OK    6553 bytes    301 ms    compr
user terminated

It is sometimes interesting to check the time required to complete the
request with and without the HTTP compression just including/excluding the *
compr* option from the command line. A few more options

   - *http10* tells wbox to use HTTP/1.0 in the request, avoiding chunked
   data output.
   - *head* forces wbox to use the HEAD method instead of GET.
   - *close* close the connection after few bytes received. Handy to check
   just latency against big pages/files, to check what happens on end of file
   from client conditions, ...
   - Use *wbox -h* in order to list all the available options.

HTTP server mode Wbox implements a minimal configuration-less HTTP server.
It is useful as a quick way to share files in a LAN or via Internet, so it
implements directory listing by default. In order to start this mode just
use the following command line (assuming documents you want to share are in

% *wbox servermode webroot /tmp/mydocs*

Than play with it conneting to since Wbox for default
uses the *8081* TCP port. You can change this default using the *serverport
port* option. limiting number of clients in server mode The default in wbox
server mode is to handle up to 20 concurrent clients. It is possible to
tune this parameter using *maxclients number*. When a clinet connects but
there are already the maximum number of clients connected the connection is
closed before to spawn a child. This allows for an easy DOS attack so the
behaviour should be changed in two ways: a timeout should be implemented in
order to avoid that a client can hang forever, also on a new connection
that can't be server because too many clients are already connected a
random old connection should be killed. Have funhttp://www.hping.org/wbox/

11 Mayıs 2012 09:15 tarihinde İbrahim Ercan <ibrahim.ercan at engineer.com>yazdı:

> hping get veya post istekleri yapamıyor. Post ya da get isteğini ip spoof
> ile yaparsanız tcp 3lü el sıkışma gerçekleşmeyeceğinden  cevap
> dönmeyecektir zaten. Amacınızın ne oldugunu bilmiyorum ama onun yerine syn
> yollamanız aynı işi görebilir...
> 2012/5/10 Oğuzhan YILMAZ <aspsrc at gmail.com>
>> çok emin olmamakla beraber hping istediğin tipte bir http request
>> yapabiliyordu sanırım.
>> 10 Mayıs 2012 23:40 tarihinde Volkan Altan <volkanaltan at gmail.com> yazdı:
>>> Merhaba,
>>> www.abc.com/a/b sayfasına bana ait olmayan bir IP den post, get isteği
>>> yapabilir miyim ?
>>> Burda geri dönüş değeri önemli değil. Ben sadece post yapıp cevaba
>>> bakmayacağım bile.
>>> ip spoofing ile doğrudan IP adresine isteiğimiz port ve source ip den
>>> istek yapabiliyoruz http isteğide yapabilir miyimiz?
>>> Teşekkürler
>>> Volkan Altan
>>> http://volkanaltan.com/
>>> İyi  Çalışmalar.
>>> _______________________________________________
>>> Owasp-turkey mailing list
>>> Owasp-turkey at lists.owasp.org
>>> https://lists.owasp.org/mailman/listinfo/owasp-turkey
>> --
>> Oğuzhan
>> _______________________________________________
>> Owasp-turkey mailing list
>> Owasp-turkey at lists.owasp.org
>> https://lists.owasp.org/mailman/listinfo/owasp-turkey
> --
> *İbrahim Ercan
> **
> *
> _______________________________________________
> Owasp-turkey mailing list
> Owasp-turkey at lists.owasp.org
> https://lists.owasp.org/mailman/listinfo/owasp-turkey
-------------- sonraki b?l?m --------------
Bir HTML eklentisi temizlendi...
URL: <http://lists.owasp.org/pipermail/owasp-turkey/attachments/20120511/8aab0532/attachment-0001.html>

More information about the Owasp-turkey mailing list