XX-net/XX-Net · warning

%s %s %s haking

Error message

%s %s %s haking

What it means

Path-traversal guard: if the request path contains '..', the server writes a raw 404 and logs '<client> GET <path> haking'. The request is terminated without normal response handling.

Source

Thrown at code/default/launcher/web_control.py:207

    def do_GET(self):
        self.headers = utils.to_str(self.headers)
        self.path = utils.to_str(self.path)

        refer = self.headers.get('Referer')
        if refer:
            refer_loc = urlparse(refer).netloc
            host = self.headers.get('Host')
            if refer_loc != host and refer_loc not in config.allowed_refers:
                xlog.warn("web control ref:%s host:%s", refer_loc, host)
                return

            self.set_CORS(CORS_header)

        # check for '..', which will leak file
        if re.search(r'(\.{2})', self.path) is not None:
            self.wfile.write(b'HTTP/1.1 404\r\n\r\n')
            xlog.warn('%s %s %s haking', self.address_string(), self.command, self.path)
            return

        if config.webui_auth:
            auth = self.headers.get("Authorization")
            if not auth or not auth.startswith("Basic "):
                return self.send_response(content="", headers={
                    "WWW-Authenticate": 'Basic realm="Access to admin"'
                }, status=401)

            try:
                user_pass = base64.b64decode(auth[6:])
                user_pass = utils.to_str(user_pass)
                user, password = user_pass.split(":")[0:2]
            except Exception as e:
                xlog.warn("decode auth fail:%r", e)
                return self.send_response(content="", headers={
                    "WWW-Authenticate": 'Basic realm="Access to admin"'
                }, status=401)

View on GitHub (pinned to cfa5bc17b6)

Solutions

  1. Keep the control port bound to 127.0.0.1 / behind a firewall.
  2. Set a webui_auth password.
  3. If triggered by your own client, remove '..' segments from requested paths.
  4. Ignore when seen from unknown IPs — it's an attack probe, not a bug.
Defensive patterns

Strategy: validation

Validate before calling

if '..' in self.path:
    return send_404()  # block traversal before routing

Type guard

def safe_path(p):
    return '..' not in p

Prevention

When it happens

Trigger: Any GET whose URL contains '..' — e.g. /../../etc/passwd, /web_ui/..%2F..%2F — from scanners, malicious clients, or occasionally over-aggressive URL normalization in a client.

Common situations: Internet-exposed control port probed by bots; a misconfigured reverse proxy rewriting paths with '..'.

Related errors

AI-assisted analysis of XX-net/XX-Net@cfa5bc17b6 (2026-08-27). Data as JSON: /api/errors/86dbbd9430cbe7b8. Report an issue: GitHub.