Skip to content

Instantly share code, notes, and snippets.

@fearblackcat
Last active May 30, 2018 06:40
Show Gist options
  • Save fearblackcat/0caf3999a44dec41335f6bbcaef71e40 to your computer and use it in GitHub Desktop.
Save fearblackcat/0caf3999a44dec41335f6bbcaef71e40 to your computer and use it in GitHub Desktop.
http go request for hijacker

For http hijacker

package main

import (
  "crypto/tls"
  "fmt"
  "net"
  "net/http"
  "net/http/httputil"
  "time"
)

func main() {
  http.HandleFunc("/hijack", func(res http.ResponseWriter, req *http.Request) {
    conn, _, err := res.(http.Hijacker).Hijack()
    if err != nil {
      panic(err)
    }
    conn.Write([]byte{})
    fmt.Fprintf(conn, "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\n\r\n")

    buffer := make([]byte, 1024)
    fmt.Println("Server : Enter routine")
    for {
      time.Sleep(1 * time.Second)
      fmt.Println("Server : I send")
      _, err = conn.Write([]byte("Hijack server"))
      if err != nil {
        panic(err)
      }
      fmt.Println("Server : I'm receiving")
      n, err := conn.Read(buffer)
      if err != nil {
        panic(err)
      }
      fmt.Printf("Server : %d bytes from client : %s\n", n, string(buffer))
    }
  })


  go runClient()

  err := http.ListenAndServe(":8081", nil)
  if err != nil {
    panic(err)
  }
}

func runClient() {
  time.Sleep(1 * time.Second)
  req, err := http.NewRequest("GET", "/hijack", nil)
  if err != nil {
    panic(err)
  }

  dial, err := net.Dial("tcp", "localhost:8081")
  if err != nil {
    panic(err)
  }
  conn := httputil.NewClientConn(dial, nil)

  fmt.Println("Client : do request through http connection")
  _, err = conn.Do(req)
  if err != httputil.ErrPersistEOF && err != nil {
    panic(err)
  }

  fmt.Println("Client : hijack https connection")
  connection, reader := conn.Hijack()

  buffer := make([]byte, 1024)
  fmt.Println("Client : Enter client routine")
  for {
    time.Sleep(250 * time.Millisecond)
    n, err := reader.Read(buffer)
    if err != nil {
      panic(err)
    }
    fmt.Printf("Receive %n bytes : %s\n", n, string(buffer))
    connection.Write([]byte("I am FOO"))
  }
}

For http tls hijacker request

package main

import (
  "crypto/tls"
  "fmt"
  "net"
  "net/http"
  "net/http/httputil"
  "time"
)

func main() {
  http.HandleFunc("/hijack", func(res http.ResponseWriter, req *http.Request) {
    conn, _, err := res.(http.Hijacker).Hijack()
    if err != nil {
      panic(err)
    }
    conn.Write([]byte{})
    fmt.Fprintf(conn, "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\n\r\n")

    buffer := make([]byte, 1024)
    fmt.Println("Server : Enter routine")
    for {
      time.Sleep(1 * time.Second)
      fmt.Println("Server : I send")
      _, err = conn.Write([]byte("Hijack server"))
      if err != nil {
        panic(err)
      }
      fmt.Println("Server : I'm receiving")
      n, err := conn.Read(buffer)
      if err != nil {
        panic(err)
      }
      fmt.Printf("Server : %d bytes from client : %s\n", n, string(buffer))
    }
  })


  go runClient()

  err := http.ListenAndServeTLS(":8081", "./server.crt", "./server.key", nil)
  if err != nil {
    panic(err)
  }
}

func runClient() {
  time.Sleep(1 * time.Second)
  req, err := http.NewRequest("GET", "/hijack", nil)
  if err != nil {
    panic(err)
  }

  dial, err := net.Dial("tcp", "localhost:8081")
  if err != nil {
    panic(err)
  }
  tls_conn := tls.Client(dial, &tls.Config{InsecureSkipVerify : true})
  conn := httputil.NewClientConn(tls_conn, nil)
  _, err = conn.Do(req)
  if err != httputil.ErrPersistEOF && err != nil {
    panic(err)
  }

  fmt.Println("Client : hijack https connection")
  connection, reader := conn.Hijack()

  buffer := make([]byte, 1024)
  fmt.Println("Client : Enter client routine")
  for {
    time.Sleep(250 * time.Millisecond)
    n, err := reader.Read(buffer)
    if err != nil {
      panic(err)
    }
    fmt.Printf("Receive %n bytes : %s\n", n, string(buffer))
    connection.Write([]byte("I am FOO"))
  }
}

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment