{"record":{"id":"b2dfba5b2d22a1be","repo":"XX-net/XX-Net","slug":"s-s-s-haking","errorCode":null,"errorMessage":"%s %s %s haking","messagePattern":"(.+?) (.+?) (.+?) haking","errorType":"console","errorClass":null,"httpStatus":404,"severity":"warning","filePath":"code/default/gae_proxy/local/web_control.py","lineNumber":192,"sourceCode":"\n            if file_path.endswith('.html'):\n                mimetype = 'text/html'\n            elif file_path.endswith('.png'):\n                mimetype = 'image/png'\n            elif file_path.endswith('.jpg') or file_path.endswith('.jpeg'):\n                mimetype = 'image/jpeg'\n            else:\n                mimetype = 'application/octet-stream'\n\n            self.send_file(file_path, mimetype)\n            return\n        else:\n            xlog.warn('Control Req %s %s %s ', self.address_string(), self.command, self.path)\n\n        # check for '..', which will leak file\n        if re.search(r'(\\.{2})', self.path) is not None:\n            self.wfile.write(b'HTTP/1.1 404\\r\\n\\r\\n')\n            xlog.warn('%s %s %s haking', self.address_string(), self.command, self.path )\n            return\n\n\n        filename = os.path.normpath('./' + path)\n        if self.path.startswith(('http://', 'https://')):\n            data = b'HTTP/1.1 200\\r\\nCache-Control: max-age=86400\\r\\nExpires:Oct, 01 Aug 2100 00:00:00 GMT\\r\\nConnection: close\\r\\n'\n\n            data += b'\\r\\n'\n            self.wfile.write(data)\n            xlog.info('%s \"%s %s HTTP/1.1\" 200 -', self.address_string(), self.command, self.path)\n        elif os.path.isfile(filename):\n            if filename.endswith('.pac'):\n                mimetype = 'text/plain'\n            else:\n                mimetype = 'application/octet-stream'\n            #self.send_file(filename, mimetype)\n        else:\n            self.wfile.write(b'HTTP/1.1 404\\r\\nContent-Type: text/plain\\r\\nConnection: close\\r\\n\\r\\n404 Not Found')","sourceCodeStart":174,"sourceCodeEnd":210,"githubUrl":"https://github.com/XX-net/XX-Net/blob/cfa5bc17b67676e467f37ec50766127e0ab5f0aa/code/default/gae_proxy/local/web_control.py#L174-L210","documentation":"The web control handler detected '..' in the request path, a classic path-traversal attempt, and rejected it with a 404 ('haking' = hacking). The logged fields identify the client and the offending path.","triggerScenarios":"Any request whose self.path contains two consecutive dots, e.g. GET /../../etc/passwd — including encoded variants that were decoded earlier.","commonSituations":"Automated scanners or casual probing of the local control port; occasionally a legitimate client issuing a path containing '..' segments. Note the control server listens locally, so exposure means something else is reaching it.","solutions":["If self-triggered: remove '..' from client URLs","Ensure the web control port is only bound to 127.0.0.1 and not exposed","Ignore: the request was already blocked with 404"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"import re\nif re.search(r'(\\.\\.)', path):\n    return 404  # reject before touching the filesystem","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep the control server bound to loopback only","Never accept raw user paths in file-serving endpoints; use a whitelist"],"tags":["security","path-traversal","web-control"],"backgroundTag":"path-traversal-attempt","analyzedSha":"cfa5bc17b67676e467f37ec50766127e0ab5f0aa","analyzedAt":"2026-08-27T19:28:28.225Z","schemaVersion":2},"datasetVersion":"2026-08-28T00:17:15.603Z"}