Re:Make HTTP requests from your browser
by tomblomfield on Sunday January 08, 2012 @02:50PM
(#3440337)
By "services like this", I hope you mean websites that are vulnerable to SQL injection, and not Hurl itself?
Hoping that an attacker can't use curl probably isn't a good security solution...
Yes, not Hurl itself. But Hurl can be used to execute malicious statements.
It is a difference, whether an attacker uses his own IP address (or a setup with various VPNs and proxies) or uses Hurl for it so that the target website sees only Hurl's IP in its logs.
In times of free WiFi, the traceability of malicious requests is definitely reduced anyway, but Hurl could potentially add another layer that can be used by an attacker to obscure his/her origin. I'm not saying that this is a major security issue, it is just a flaw by design, which I wanted to point out.
Do you happen to know how translate.google.com deals with this problem ?
Re:Make HTTP requests from your browser
by tlrobinson on Sunday January 08, 2012 @06:39PM
(#3440893)
Meh, if abuse is really a problem Hurl could log requests and cooperate with law enforcement to trace it right back to you.
If an attacker is relying on using Hurl as their only source of anonymity they're not very competent.
You can make a browser GET or POST to any arbitrary URL already via JavaScript.
Yeah they are potentially liable to the same sort of issues that proxies are which can make for a legally vulnerable service - unfortunate but true
There is a http header, which you can set as proxy which reveals the ip of the original requester. Maybe that would be a good first step.
On mobile so i can't check myself: does The BROWSER makes the request by some clever way? Or simple server side script does it?
Re:Make HTTP requests from your browser
by lancefisher on Sunday January 08, 2012 @05:13PM
(#3440672)
It's a ruby app, and uses curl on the server to make the request: https://github.com/defunkt/hurl/blob/master/app/app.rb
What I want to say is that services like this have a security flaw by design which allows random people to execute strange statements in the name of Hurl.
There are certainly other ways to execute malicious HTTP requests (for example, let the Google Bot do it), but still, it should be pointed out.