4 ms·
I wonder how many sites have left the /debug/pprof endpoint enabled in production. Sounds like something pentesters should keep in mind.
by comex 9y ago
I wonder how many sites have left the /debug/pprof endpoint enabled in production. Sounds like something pentesters should keep in mind.
- jerf 9y agohttp://mmcloughlin.com/posts/your-pprof-is-showing http://mmcloughlin.com/posts/your-pprof-is-showing - "Golang’s net/http/pprof package is incredibly powerful: it’s trivial to debug a running production server. In the process it’s equally easy to accidentally expose your debugging information to the world. In this post we use the zmap project to show this is a real problem in the wild, and explain preventative measures you can take."
- rqs 9y agoHowever it's not very hard to wrap pprof's HTTP handlers with your own one, so you can add a layer of protection for it.
- eighthnate 9y agoPretty much any brute force pentesters will check for exposed endpoints of any kind or anything open/accessible on a network and/or a particular server/desktop/system. Security software are pretty thorough nowadays.