Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

TIL: You can make HTTP requests without curl using Bash /dev/TCP

mareksuppa.com

Post reply on HN
Print view View original

141–150 of 255 posts

Re: TIL: You can make HTTP requests without curl using Bash /dev/TCP

#141

Post by xp84 »

NewJazz wrote: post #96
xmodem wrote: post #91

Earlier quoted context omitted.

Yup! They are a good solution to the massive problem you caused for yourself by implementing a different "solution" to a non-problem. And even that's only true if you assume kubernetes is the only place your container runs where you might want to also debug it.

You want to ship every debug utility you will need in every image? Just seems wasteful. What about 3rd party images, you will respin images just to add your preferred toolset?

> every debug utility you will need in every image? Just seems wasteful

How wasteful though? I have to admit, I envy the person whose codebase itself they have to support is so lean and space-conservative that the size of the gnu coreutils, curl, nano, etc., would show up as anything but a rounding error in the image size.

I see it like putting a thermometer in a turkey before I stick it in the oven. Sure, the thermometer adds thermal mass itself, making the turkey take a few seconds longer to cook, but the value of it being there is greater than the cost imposed.

Re: TIL: You can make HTTP requests without curl using Bash /dev/TCP

#142

Post by xp84 »

QuantumNomad_ wrote: post #26
simonw wrote: post #16

Neat, works against example.com exec 3 /dev/tcp/example.com/80 printf 'GET / HTTP/1.1\r\nHost: example.com\r\nConnection: close\r\n\r\n' >&3 cat Outputs: HTTP/1.1 200 OK Date: Tue, 16 Jun 2026 17:37:45 GMT Content-Type: text/html ... I always end up on example.com for this kind of thing because there are so few domains these days that don't enforce https!

example.com is also great for that reason when something fails about a captive portal on a public WiFi. I open my web browser and go to http://example.com and get redirected to the captive portal page again and retry completing what they need from me to get internet access.

I have been using neverssl.com for this same purpose :)

My only concern would be that example.com doesn't promise to never do the 'required SSL' thing.

Re: TIL: You can make HTTP requests without curl using Bash /dev/TCP

#143

Post by xp84 »

QuantumNomad_ wrote: post #51
some_random wrote: post #34

Earlier quoted context omitted.

Fun fact, this is almost exactly how active portal detection is done in the OS/browser! https://gist.github.com/skull-squadron/edb8c0122f902013304c0...

Yep :) I just find example.com easier to remember and quicker to type than any of the OS or browser makers own URLs like - http://captive.apple.com/ - http://connectivitycheck.gstatic.com/generate_204 - http://detectportal.brave-http-only.com/ Plus, it feels nice to depend on the reserved domain name example.com instead of relying on a domain that any one specific corporation has to maintain :D

What gives you confidence example.com won't start serving the HTTPS redirect though? There isn't any reason they wouldn't, and given that browsers are clearly tending towards showing big scary warnings to even accessing something over cleartext, I wouldn't be surprised if they flipped that switch just to avoid confusing noobs.

Re: TIL: You can make HTTP requests without curl using Bash /dev/TCP

#144

Post by fc417fc802 »

sisve wrote: post #104
mrshu wrote: post #52

Earlier quoted context omitted.

It's pretty rough to learn I sound like Claude. Will need to do something about it then. (For what it's worth I did write the message above manually but I understand why no one would believe that now. At least I did not call netcat "load-bearing" [ https://mareksuppa.com/til/load-bearing/ ] or something...)

I did not think you sounded like claude. Then I looked again after the comment was made and then I saw some of the vibes. Like acknowledging a mistake you have done. Before that would just made you top 5% (or maybe top 1%) of the nicest people to talk too.. know ppl think you are Claude. We are all going crazy s a sibling comment said.

It's wasn't "acknowledging the mistake" it was the phrasing and general structure while doing so.

Re: TIL: You can make HTTP requests without curl using Bash /dev/TCP

#145

Post by BearOso »

mrshu wrote: post #52
bearjaws wrote: post #20

Earlier quoted context omitted.

This is the most Claude pilled comment I've seen here.

It's pretty rough to learn I sound like Claude. Will need to do something about it then. (For what it's worth I did write the message above manually but I understand why no one would believe that now. At least I did not call netcat "load-bearing" [ https://mareksuppa.com/til/load-bearing/ ] or something...)

Avoid the backtick quotes, too. Claude also mistakenly uses them outside of markdown.

Re: TIL: You can make HTTP requests without curl using Bash /dev/TCP

#147

Post by charles_f »

xenadu02 wrote: post #68

As a kid in the late 90s my mind was blown when I realized I could telnet to port 80, 25, or 110 and interact with the servers manually. Simple get: GET / HTTP/1.1 Content-Type: text/html User-Agent: l33t hax0rs lol X-Funny-Monkey: farts For sending a mail message on port 25: HELO mail-from: whoever@whatever.com mail-to: sysadmin@yaya.com Body of the message yay. POP3 was so long ago I forgot but you could list the m…

I sent many an email from jacques.chirac@elysee.fr, the veneer of the terminal helping, my friends were quite impressed by how good a hacker I was. Good olde days when many DKIM/SPF weren't a thing yet and SMTP servers weren't even authenticated.

Re: TIL: You can make HTTP requests without curl using Bash /dev/TCP

#148

Post by fc417fc802 »

xmodem wrote: post #64
OptionOfT wrote: post #57

Earlier quoted context omitted.

If the base image I use is based on Debian, it comes with more than 15 binaries that I don't use. But when Docker scans my image and notices that there is a CVE in one of those binaries, my image is currently out of compliance. FROM scratch just reduces the surface.

> FROM scratch just reduces the surface. The actual attack surface of your application? Or the attack surface of you and your team's attention from a busybody security org. It's important not to confuse the two.

Both. Many attacks take the form of an exploit to get a shell, then using available utilities to exploit the kernel to escape to the host. If your image has neither a shell nor utilities that won't get very far.
Post reply on HN