Skip to content

Commit a2dad35

Browse files
committed
Update README
1 parent eea0e18 commit a2dad35

1 file changed

Lines changed: 47 additions & 8 deletions

File tree

README.md

Lines changed: 47 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,33 @@
11
# Http11Probe
22

3-
HTTP/1.1 server compliance and hardening tester. Sends malformed, ambiguous, and oversized requests over raw TCP sockets and checks responses against RFC 9110/9112 requirements.
3+
HTTP/1.1 server compliance and security tester. Sends malformed, ambiguous, and oversized requests over raw TCP sockets and validates responses against RFC 9110/9112 requirements.
44

5-
## Test Categories
5+
**Website:** [mda2av.github.io/Http11Probe](https://MDA2AV.github.io/Http11Probe/) — full documentation, test glossary with RFC citations, and live probe results across all tested servers.
66

7-
- **Compliance** — RFC 9110/9112 protocol requirements (bare LF, obs-fold, missing Host, invalid versions, etc.)
8-
- **Smuggling** — CL/TE ambiguity, duplicate Content-Length, pipeline probes, obfuscation vectors
9-
- **Malformed Input** — Binary garbage, oversized URLs/headers, control characters, integer overflow
7+
## 116 Tests across 3 Categories
8+
9+
| Category | Tests | What it covers |
10+
|----------|------:|----------------|
11+
| **Compliance** | 47 | RFC 9110/9112 protocol requirements — bare LF, obs-fold, missing Host, invalid versions, chunked encoding, upgrade handling, etc. |
12+
| **Smuggling** | 50 | CL/TE ambiguity, duplicate Content-Length, pipeline desync, TE obfuscation, chunk extension abuse, bare LF in chunked framing |
13+
| **Malformed Input** | 19 | Binary garbage, oversized URLs/headers/methods, NUL bytes, control characters, integer overflow, HTTP/2 preface |
14+
15+
Each test is scored against RFC normative language (MUST/SHOULD/MAY) and classified as **Pass**, **Fail**, or **Warn** (when the RFC permits both strict and lenient behavior).
16+
17+
## 31 Server Targets
18+
19+
Tested across 8 languages:
20+
21+
| Language | Servers |
22+
|----------|---------|
23+
| C# | Kestrel, EmbedIO, GenHTTP, Glyph11, NetCoreServer, ServiceStack, SimpleW, Sisk, Watson |
24+
| Rust | Actix, Hyper, Ntex, Pingora |
25+
| Go | Caddy, FastHTTP, Gin, Traefik |
26+
| Java | Jetty, Quarkus, Spring Boot |
27+
| JavaScript | Bun, Express, Node |
28+
| C | Apache, H2O, HAProxy, Nginx |
29+
| C++ | Drogon, Envoy, Lithium |
30+
| Python | Flask |
1031

1132
## Usage
1233

@@ -20,16 +41,34 @@ dotnet run --project src/Http11Probe.Cli -- --host localhost --port 8080
2041
|------|-------------|---------|
2142
| `--host` | Target host | `localhost` |
2243
| `--port` | Target port | `8080` |
23-
| `--category` | Filter by category | all |
24-
| `--timeout` | Connect/read timeout (seconds) | `5` |
44+
| `--category` | Filter by category (`Compliance`, `Smuggling`, `MalformedInput`) | all |
45+
| `--timeout` | Connect/read timeout in seconds | `5` |
2546
| `--output` | Write JSON report to file ||
2647

48+
### Example
49+
50+
```
51+
dotnet run --project src/Http11Probe.Cli -- --host localhost --port 8080 --output results.json
52+
```
53+
54+
Results stream to the console as each test completes, with a summary at the end:
55+
56+
```
57+
Score: 97/97 19 warnings (116 tests, 35.5s)
58+
```
59+
2760
## Building
2861

62+
Requires .NET 10 SDK.
63+
2964
```
3065
dotnet build Http11Probe.slnx
3166
```
3267

68+
## CI
69+
70+
The [Probe workflow](.github/workflows/probe.yml) runs on PRs and `workflow_dispatch`. It builds each server's Docker image, probes it, and posts a comparison table as a PR comment.
71+
3372
## Results
3473

35-
See the [live comparison](https://MDA2AV.github.io/Http11Probe/probe-results/) across 12 HTTP servers.
74+
See the [live comparison](https://MDA2AV.github.io/Http11Probe/probe-results/) across all servers, or browse the [test glossary](https://MDA2AV.github.io/Http11Probe/docs/) for per-test RFC references and explanations.

0 commit comments

Comments
 (0)