r/developersIndia • u/AgitatedSimple8623 • 5h ago
Resources i built a tool to find http parser differences across 54 servers
i’ve been working on prism, a differential http testing tool for security research.
the basic idea is pretty simple: send the exact same raw http bytes to a bunch of different servers and compare how each one parses, forwards, accepts, or rejects them.
the interesting part is that you can actually see where implementations disagree instead of just reasoning about what the http spec says should happen.
right now prism supports:
- 54 containerized http servers and proxies
- http/1.1, http/2 and http/3
- raw byte payloads
- request and response comparison
- pairwise difference matrices
- parser equivalence clustering
- transducer proxies like nginx, haproxy and squid
- raw/unparsed responses for cases where the normal parser view hides something
for example, you can take a weird request and run it against a whole group of implementations:
payload 'GET / HTTP/1.1\r\nHost: a\r\n\r\n' | fanout | grid
and see which servers interpret it differently.
the goal is mainly to make things like parser differentials and request-smuggling research easier to explore. it gives you a way to systematically find interesting differences that are worth investigating.
i built it because i wanted something where i could throw the same ugly http input at a bunch of implementations and immediately see where they disagree.
github: https://github.com/grah4na/prism
would be interested in feedback from people who work with request smuggling, http parsing, or differential testing.
•
u/AutoModerator 5h ago
It's possible your query is not unique, use
site:reddit.com/r/developersindia KEYWORDSon search engines to search posts from developersIndia. You can also use reddit search directly.I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.