{"record":{"id":"86dbbd9430cbe7b8","repo":"XX-net/XX-Net","slug":"s-s-s-haking-86dbbd","errorCode":null,"errorMessage":"%s %s %s haking","messagePattern":"(.+?) (.+?) (.+?) haking","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"code/default/launcher/web_control.py","lineNumber":207,"sourceCode":"\n    def do_GET(self):\n        self.headers = utils.to_str(self.headers)\n        self.path = utils.to_str(self.path)\n\n        refer = self.headers.get('Referer')\n        if refer:\n            refer_loc = urlparse(refer).netloc\n            host = self.headers.get('Host')\n            if refer_loc != host and refer_loc not in config.allowed_refers:\n                xlog.warn(\"web control ref:%s host:%s\", refer_loc, host)\n                return\n\n            self.set_CORS(CORS_header)\n\n        # check for '..', which will leak file\n        if re.search(r'(\\.{2})', self.path) is not None:\n            self.wfile.write(b'HTTP/1.1 404\\r\\n\\r\\n')\n            xlog.warn('%s %s %s haking', self.address_string(), self.command, self.path)\n            return\n\n        if config.webui_auth:\n            auth = self.headers.get(\"Authorization\")\n            if not auth or not auth.startswith(\"Basic \"):\n                return self.send_response(content=\"\", headers={\n                    \"WWW-Authenticate\": 'Basic realm=\"Access to admin\"'\n                }, status=401)\n\n            try:\n                user_pass = base64.b64decode(auth[6:])\n                user_pass = utils.to_str(user_pass)\n                user, password = user_pass.split(\":\")[0:2]\n            except Exception as e:\n                xlog.warn(\"decode auth fail:%r\", e)\n                return self.send_response(content=\"\", headers={\n                    \"WWW-Authenticate\": 'Basic realm=\"Access to admin\"'\n                }, status=401)","sourceCodeStart":189,"sourceCodeEnd":225,"githubUrl":"https://github.com/XX-net/XX-Net/blob/cfa5bc17b67676e467f37ec50766127e0ab5f0aa/code/default/launcher/web_control.py#L189-L225","documentation":"Path-traversal guard: if the request path contains '..', the server writes a raw 404 and logs '<client> GET <path> haking'. The request is terminated without normal response handling.","triggerScenarios":"Any GET whose URL contains '..' — e.g. /../../etc/passwd, /web_ui/..%2F..%2F — from scanners, malicious clients, or occasionally over-aggressive URL normalization in a client.","commonSituations":"Internet-exposed control port probed by bots; a misconfigured reverse proxy rewriting paths with '..'.","solutions":["Keep the control port bound to 127.0.0.1 / behind a firewall.","Set a webui_auth password.","If triggered by your own client, remove '..' segments from requested paths.","Ignore when seen from unknown IPs — it's an attack probe, not a bug."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"if '..' in self.path:\n    return send_404()  # block traversal before routing","typeGuard":"def safe_path(p):\n    return '..' not in p","tryCatchPattern":null,"preventionTips":["Bind the control port to localhost only.","Enable webui_auth.","Treat hits as scanning noise; audit exposure."],"tags":["security","path-traversal","http","web-ui"],"backgroundTag":"path-traversal-attempt","analyzedSha":"cfa5bc17b67676e467f37ec50766127e0ab5f0aa","analyzedAt":"2026-08-27T19:28:28.225Z","schemaVersion":2},"datasetVersion":"2026-08-28T00:17:15.603Z"}