Debug flags `-v` and `-silent` behavior #145

mjkim610 · 2022-07-26T15:10:12Z

mjkim610
Jul 26, 2022

Could somebody confirm that this is the intended -v flag and -silent flag behavior?

My intuition is that the -v and -silent flags should be mutually exclusive, and that an error/exception should occur when both are set.

No flags:

$ ./proxify.exe 

                       _ ___
   ___  _______ __ __ (_) _/_ __      
  / _ \/ __/ _ \\ \ // / _/ // /      
 / .__/_/  \___/_\_\/_/_/ \_, /       
/_/                      /___/  v0.0.7

                projectdiscovery.io

Use with caution. You are responsible for your actions
Developers assume no liability and are not responsible for any misuse or damage.
HTTP Proxy Listening on 127.0.0.1:8888
Socks5 Proxy Listening on 127.0.0.1:10080
Saving traffic to logs
2022/07/27 00:06:28 [001] WARN: Cannot handshake client optimizationguide-pa.googleapis.com:443 remote error: tls: unknown certificate

-silent flag:

$ ./proxify.exe -silent

-v flag:

$ ./proxify.exe -v

                       _ ___
   ___  _______ __ __ (_) _/_ __
  / _ \/ __/ _ \\ \ // / _/ // /
 / .__/_/  \___/_\_\/_/_/ \_, /
/_/                      /___/  v0.0.7

                projectdiscovery.io

Use with caution. You are responsible for your actions
Developers assume no liability and are not responsible for any misuse or damage.
HTTP Proxy Listening on 127.0.0.1:8888
Socks5 Proxy Listening on 127.0.0.1:10080
Saving traffic to logs
2022/07/27 00:06:44 [001] INFO: Running 3 CONNECT handlers
2022/07/27 00:06:44 [001] INFO: on 1th handler: &{2 <nil> 0xdb1280} optimizationguide-pa.googleapis.com:443
2022/07/27 00:06:44 [001] INFO: Assuming CONNECT is TLS, mitm proxying it
2022/07/27 00:06:44 [002] INFO: Got request /online/ quietinnershiningtreasure.neverssl.com GET http://quietinnershiningtreasure.neverssl.com/online/
GET http://quietinnershiningtreasure.neverssl.com/online/ HTTP/1.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9      
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9,ko-KR;q=0.8,ko;q=0.7
Cache-Control: max-age=0
Dnt: 1
If-Modified-Since: Wed, 29 Jun 2022 00:23:22 GMT
If-None-Match: "8be-5e28b29291e10-gzip"
Proxy-Connection: keep-alive
Referer: http://neverssl.com/
Sec-Gpc: 1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36

2022/07/27 00:06:44 [002] INFO: Sending request GET http://quietinnershiningtreasure.neverssl.com/online/
2022/07/27 00:06:44 [001] WARN: Cannot handshake client optimizationguide-pa.googleapis.com:443 remote error: tls: unknown certificate
2022/07/27 00:06:44 [002] INFO: Received response 200 OK
HTTP/1.1 200 OK
Accept-Ranges: bytes
Connection: Upgrade
Content-Type: text/html; charset=UTF-8
Date: Tue, 26 Jul 2022 15:06:44 GMT
Etag: "8be-5e28b29291e10-gzip"
Last-Modified: Wed, 29 Jun 2022 00:23:22 GMT
Server: Apache/2.4.53 ()
Upgrade: h2,h2c
Vary: Accept-Encoding

<html>
        <head>
                <title>NeverSSL - helping you get online</title>

                <style>
                body {
                        font-family: Montserrat, helvetica, arial, sans-serif;
                        font-size: 16x;
                        color: #444444;
                        margin: 0;
                }
                h2 {
                        font-weight: 700;
                        font-size: 1.6em;
                        margin-top: 30px;
                }
                p {
                        line-height: 1.6em;
                }
                .container {
                        max-width: 650px;
                        margin: 20px auto 20px auto;
                        padding-left: 15px;
                        padding-right: 15px
                }
                .header {
                        background-color: #42C0FD;
                        color: #FFFFFF;
                        padding: 10px 0 10px 0;
                        font-size: 2.2em;
                }
                <!-- CSS from Mark Webster https://gist.github.com/markcwebster/9bdf30655cdd5279bad13993ac87c85d -->
                </style>
        </head>
        <body>

        <div class="header">
                <div class="container">
                <h1>NeverSSL</h1>
                </div>
        </div>

        <div class="content">
        <div class="container">

        <h2>What?</h2>
        <p>This website is for when you try to open Facebook, Google, Amazon, etc
        on a wifi network, and nothing happens. Type "http://neverssl.com"
        into your browser's url bar, and you'll be able to log on.</p>

        <h2>How?</h2>
        <p>neverssl.com will never use SSL (also known as TLS). No
        encryption, no strong authentication, no <a
        href="https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security">HSTS</a>,
        no HTTP/2.0, just plain old unencrypted HTTP and forever stuck in the dark
        ages of internet security.</p>

        <h2>Why?</h2>
        <p>Normally, that's a bad idea. You should always use SSL and secure
        encryption when possible. In fact, it's such a bad idea that most websites
        are now using https by default.</p>

        <p>And that's great, but it also means that if you're relying on
        poorly-behaved wifi networks, it can be hard to get online.  Secure
        browsers and websites using https make it impossible for those wifi
        networks to send you to a login or payment page. Basically, those networks
        can't tap into your connection just like attackers can't. Modern browsers
        are so good that they can remember when a website supports encryption and
        even if you type in the website name, they'll use https.</p>

        <p>And if the network never redirects you to this page, well as you can
        see, you're not missing much.</p>

        <a href="https://twitter.com/neverssl">Follow @neverssl</a>

        </div>
        </div>
        </body>
</html>
2022/07/27 00:06:44 [002] INFO: Copying response to client 200 OK [200]
2022/07/27 00:06:44 [002] INFO: Copied 2238 bytes to client error=<nil>

-silent and -v flag together:

$ ./proxify.exe -v -silent
GET http://quietinnershiningtreasure.neverssl.com/online/ HTTP/1.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9,ko-KR;q=0.8,ko;q=0.7
Cache-Control: max-age=0
Dnt: 1
If-Modified-Since: Wed, 29 Jun 2022 00:23:22 GMT
If-None-Match: "8be-5e28b29291e10-gzip"
Proxy-Connection: keep-alive
Referer: http://neverssl.com/
Sec-Gpc: 1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36

HTTP/1.1 200 OK
Accept-Ranges: bytes
Connection: Upgrade
Content-Type: text/html; charset=UTF-8
Date: Tue, 26 Jul 2022 15:06:51 GMT
Etag: "8be-5e28b29291e10-gzip"
Last-Modified: Wed, 29 Jun 2022 00:23:22 GMT
Server: Apache/2.4.53 ()
Upgrade: h2,h2c
Vary: Accept-Encoding

<html>
        <head>
                <title>NeverSSL - helping you get online</title>

                <style>
                body {
                        font-family: Montserrat, helvetica, arial, sans-serif;
                        font-size: 16x;
                        color: #444444;
                        margin: 0;
                }
                h2 {
                        font-weight: 700;
                        font-size: 1.6em;
                        margin-top: 30px;
                }
                p {
                        line-height: 1.6em;
                }
                .container {
                        max-width: 650px;
                        margin: 20px auto 20px auto;
                        padding-left: 15px;
                        padding-right: 15px
                }
                .header {
                        background-color: #42C0FD;
                        color: #FFFFFF;
                        padding: 10px 0 10px 0;
                        font-size: 2.2em;
                }
                <!-- CSS from Mark Webster https://gist.github.com/markcwebster/9bdf30655cdd5279bad13993ac87c85d -->
                </style>
        </head>
        <body>

        <div class="header">
                <div class="container">
                <h1>NeverSSL</h1>
                </div>
        </div>

        <div class="content">
        <div class="container">

        <h2>What?</h2>
        <p>This website is for when you try to open Facebook, Google, Amazon, etc
        on a wifi network, and nothing happens. Type "http://neverssl.com"
        into your browser's url bar, and you'll be able to log on.</p>

        <h2>How?</h2>
        <p>neverssl.com will never use SSL (also known as TLS). No
        encryption, no strong authentication, no <a
        href="https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security">HSTS</a>,
        no HTTP/2.0, just plain old unencrypted HTTP and forever stuck in the dark
        ages of internet security.</p>

        <h2>Why?</h2>
        <p>Normally, that's a bad idea. You should always use SSL and secure
        encryption when possible. In fact, it's such a bad idea that most websites
        are now using https by default.</p>

        <p>And that's great, but it also means that if you're relying on
        poorly-behaved wifi networks, it can be hard to get online.  Secure
        browsers and websites using https make it impossible for those wifi
        networks to send you to a login or payment page. Basically, those networks
        can't tap into your connection just like attackers can't. Modern browsers
        are so good that they can remember when a website supports encryption and
        even if you type in the website name, they'll use https.</p>

        <p>And if the network never redirects you to this page, well as you can
        see, you're not missing much.</p>

        <a href="https://twitter.com/neverssl">Follow @neverssl</a>

        </div>
        </div>
        </body>
</html>

Answered by ehsandeep

Jul 26, 2022

Hi @mjkim610, as both flag can not be used together in practical, we can add cli validation to inform the same.

View full answer

ehsandeep · 2022-07-26T23:36:37Z

ehsandeep
Jul 26, 2022
Maintainer

Hi @mjkim610, as both flag can not be used together in practical, we can add cli validation to inform the same.

0 replies

mjkim610 · 2022-07-26T23:48:11Z

mjkim610
Jul 26, 2022
Author

@ehsandeep, thanks for the clarification :)

0 replies

Navigation Menu

Repository navigation

Debug flags `-v` and `-silent` behavior #145

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Replies: 2 comments

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Debug flags -v and -silent behavior #145

Uh oh!

Uh oh!

mjkim610 Jul 26, 2022

Replies: 2 comments

Uh oh!

ehsandeep Jul 26, 2022 Maintainer

Uh oh!

mjkim610 Jul 26, 2022 Author

Debug flags `-v` and `-silent` behavior #145

mjkim610
Jul 26, 2022

ehsandeep
Jul 26, 2022
Maintainer

mjkim610
Jul 26, 2022
Author