Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

TIL: You can make HTTP requests without curl using Bash /dev/TCP

mareksuppa.com

Post reply on HN
Print view View original

131–140 of 255 posts

Re: TIL: You can make HTTP requests without curl using Bash /dev/TCP

#131

Post by Denatonium »

jazz9k wrote: post #78
xenadu02 wrote: post #68

As a kid in the late 90s my mind was blown when I realized I could telnet to port 80, 25, or 110 and interact with the servers manually. Simple get: GET / HTTP/1.1 Content-Type: text/html User-Agent: l33t hax0rs lol X-Funny-Monkey: farts For sending a mail message on port 25: HELO mail-from: whoever@whatever.com mail-to: sysadmin@yaya.com Body of the message yay. POP3 was so long ago I forgot but you could list the m…

When I was 12, I learned about open SMTP relays and how to spoof email this way. I once spoofed an email between two rivals on a community I was a part of and started a flame war. Good times.

When I was in high school in the mid 2010s, Verizon's email-to-SMS gateway didn't verify SPF/DKIM/DMARC, and I had a field day showing my classmates the Viagra ads that Hillary Clinton's "hacked" email server was sending me. In reality, it was an open relay, but Verizon didn't care; they always delivered it anyway.

Re: TIL: You can make HTTP requests without curl using Bash /dev/TCP

#132

Post by xp84 »

rahimnathwani wrote: post #127
xenadu02 wrote: post #68

As a kid in the late 90s my mind was blown when I realized I could telnet to port 80, 25, or 110 and interact with the servers manually. Simple get: GET / HTTP/1.1 Content-Type: text/html User-Agent: l33t hax0rs lol X-Funny-Monkey: farts For sending a mail message on port 25: HELO mail-from: whoever@whatever.com mail-to: sysadmin@yaya.com Body of the message yay. POP3 was so long ago I forgot but you could list the m…

Back in those days not only was there was no DKIM or SPF, most SMTP servers would accept email from anyone anywhere to anyone anywhere (i.e. 'open relay').

[ Note: Anyone who has been a geek since the 90s, there's nothing you don't already know here ]

> most SMTP servers would accept email from anyone anywhere to anyone anywhere (i.e. 'open relay').

to date that claim, I'd say that by the late 90s at least, true open relays ("from anyone to anyone") were still numerous but carried a huge assumption of being part of spam operations (willingly or through ineptitude), and the most basic spam filtering would reject mail that came out of one.

That said, (before things like SPF) it was easy enough to deliver email to anyone you wanted even if you didn't have your own real email account and SMTP server; you could just look up the destination's MX and connect to it with telnet like that. Since your own random IP probably wasn't blocklisted it would generally be accepted and delivered.

Back then it was still basically considered bad form to reject email simply because the server didn't know where it was from... sadly, if we were still playing by those rules today, I can only imagine how useless email would be. Now it's definitely guilty-till-proven-innocent.

Re: TIL: You can make HTTP requests without curl using Bash /dev/TCP

#133

Post by edoceo »

nativeit wrote: post #120
HeckFeck wrote: post #75

Earlier quoted context omitted.

I used telnet to send mail via SMTP once, it's quite literally a good social protocol because it begins with a polite 'HELO'.

Is it the reply to ‘HELO’ that enables things like tarpits? Like if my server replied with ‘HI PLEASURE TO MEET YOU 127.0.0.1 THAT NAME SOUNDS FAMILIAR ARE YOU BY CHANCE FROM BOSTON MY MOTHER IS FROM BOSTON WELL QUINCY ACTUALLY BUT DO YOU KNOW 127.0.1.1 THEY ARE A REALLY GOOD FRIEND OF MINE YOU SHOULD MEET I HEAR THEIR DAUGHTER IS A DOCTOR DONTYAKNOW AND YOU COULD…” etc, etc?

For SMTP tarpits you can do all kinds of fun stuff. Not just in the reply to helo. Like: always be slow to respond. Respond to each command with a temporary error. Accept everything, then pause, then error. Send back large chunks of garbage.

Re: TIL: You can make HTTP requests without curl using Bash /dev/TCP

#134

Post by xp84 »

asmnzxklopqw wrote: post #81
bitmasher9 wrote: post #36

Earlier quoted context omitted.

Why wouldn’t you use curl for the quick test?

Because curl is not installed in minimal docker images.

Sometimes I don't understand why people use those most tiny of images, at least for anything that they might ever ssh into.

When there is no corresponding level of restraint in the libraries that we add to most applications, does it really make a difference to leave out the likes of curl, nano, ping, etc compared to how frustrating it is to operate in just busybox (etc)?

I'm not just ranting, I'd actually like someone who swears by always shipping alpine images (etc) and never installing any basic utilities in them to share their reasoning.

Re: TIL: You can make HTTP requests without curl using Bash /dev/TCP

#135

Post by xp84 »

jolmg wrote: post #98
a-dub wrote: post #92

Earlier quoted context omitted.

the '90s version of finding the hiring manager or boss on linkedin to try and get a job was connecting to the company's public smtp server with telnet, using their name to probe different email address patterns with "rcpt to:" (those days the actual servers were often directly connected to the internet and would leak email address validity in how they would respond to rcpt to) and then sending them a nice email. smtp…

> smtp grew up to be an antisocial curmudgeon. extended smtp starts with EHLO. "EHLO" still sounds friendly. It just sounds like a different accent or something. Know someone that used to answer calls with a friendly "Jello?".

Eventually Microsoft will debut Microsoft Extended SMTP which will greet with MEHLO

Re: TIL: You can make HTTP requests without curl using Bash /dev/TCP

#137

Post by vbezhenar »

xenadu02 wrote: post #68

As a kid in the late 90s my mind was blown when I realized I could telnet to port 80, 25, or 110 and interact with the servers manually. Simple get: GET / HTTP/1.1 Content-Type: text/html User-Agent: l33t hax0rs lol X-Funny-Monkey: farts For sending a mail message on port 25: HELO mail-from: whoever@whatever.com mail-to: sysadmin@yaya.com Body of the message yay. POP3 was so long ago I forgot but you could list the m…

You can't do that with HTTP/2 (but thankfully every server still talks HTTP/1).

You also can't do that with TLS (and a lot of servers won't talk HTTP other than redirects). openssl s_client instead of telnet might allow you to tunnel text inside TLS, but that feels like a cheating.

And many other modern protocols, sadly, prefer binary encoding, which makes it impossible to tinker with it on wire level, not without specialized tools anyway.

I think people in the future will bother. I tried to make a fire with sticks once, I tried to burn a clay brick, these old things can be a lot of fun and sometimes of real use. If anything, AI actually makes tinkering a lot more easier. You don't need to dig into RFC to check your mail, you can just talk to LLM about it and it'll help you with most typical IMAP commands, for example.

Re: TIL: You can make HTTP requests without curl using Bash /dev/TCP

#138

Post by vbezhenar »

kps wrote: post #73
xenadu02 wrote: post #68

As a kid in the late 90s my mind was blown when I realized I could telnet to port 80, 25, or 110 and interact with the servers manually. Simple get: GET / HTTP/1.1 Content-Type: text/html User-Agent: l33t hax0rs lol X-Funny-Monkey: farts For sending a mail message on port 25: HELO mail-from: whoever@whatever.com mail-to: sysadmin@yaya.com Body of the message yay. POP3 was so long ago I forgot but you could list the m…

Last century I would read and send personal email from work using telnet to pop3 and smtp respectively.

You can actually do that today. In fact I did that for some time, because I didn't want to configure e-mail client. The only hard thing is HTML. Average HTML e-mail is almost impossible to read and friction to extract it to a file to open in a browser is too much.

Re: TIL: You can make HTTP requests without curl using Bash /dev/TCP

#139

Post by xp84 »

OptionOfT wrote: post #18
sevenzero wrote: post #3

Earlier quoted context omitted.

It seems pretty cool, but I am wondering if there's any drawback on just using images that support curl? I can't think of any and to me it's kinda a must have, even on production images

I always recommend to not have any dependencies outside of the code. So we start at compiling the codebase (Rust) against MUSL. That way we can run it with FROM scratch images. If we need more tooling available at runtime, then we look at alpine, but still using MUSL. If MUSL itself is proving problematic, or if some of the libraries we use need glibc then we can look at using some locked down image. The cool part ab…

preface: I'm not asking things rhetorically, I genuinely want to learn here.

> to not have any dependencies outside of the code.

> ... FROM scratch images is that you'll never have to update your base image to address CVEs...

So a FROM scratch image, basically doesn't have things like a package manager to install things, and maybe also libraries that things like curl would depend on? Sorry for my ignorance, I've heard of FROM scratch but never tried them.

Re: TIL: You can make HTTP requests without curl using Bash /dev/TCP

#140

Post by vbezhenar »

elevation wrote: post #71
thih9 wrote: post #31

Earlier quoted context omitted.

This worries me. Some AI writing styles became mainstream; at first it was the em-dashes, now it’s “A, not B” patterns and excessive acknowledging. There will be more. Was grandparent comment written by an LLM? Or is this a human who copies a style they saw in a blog post, unaware that they’re copying an AI? Or is this a human who spent too much time talking to an AI and now they just talk like this? Or is this an or…

When learning a language, I've heard it's good to find a reference speaker, such as a prolific actor, and mimic them in order to absorb several aspects of what makes them sound authentic as a speaker, such as vocabulary, intonation, diction, pacing. For many in the next generation of language learners, this reference will be Claude.

I think that the fact that AI has a very recognizable singular style is a problem. And this problem will be solved, sooner or later. It probably isn't a very important problem, because I feel that it should be relatively easy to solve (but maybe I'm wrong?).

But certainly with smarter AI I do believe it'll become more fluent with choosing more diverse idioms and phrasing, rather than repeating one thing over and over, to a point of being a comically similar. So people who learn on AI-generated text, will not learn from just one recurring style.

Post reply on HN