Can this be used to test HTTP clients?

[aaronpk]

Can you adapt this to be a malicious HTTP server so that it could be used to test whether clients are vulnerable?

[emboss]

Seems like a great idea! I'll see what I can do.

[emboss]

I guess I found something that works. Let me know if it works for you!

[aaronpk]

What did you find?

[emboss]

Oh right, I forgot to mention it :) I updated master to include a server script that allows you to test clients, too.

[emboss]

I guess I can close this now?

[aaronpk]

Sorry, didn't have a chance to try this out today, but I'm looking forward to testing it out tomorrow!

[aaronpk]

Just gave this a try. I had to change it to listen on 0.0.0.0 instead of "localhost" in order to test it from remote servers. I'm trying to verify that my services that fetch remote content or send data to callback URLs my users have registered is patched. This means I can't run the server on the local machine because these are production systems running in AWS on multiple hosts.