7 ms·
HTTP static server one-liners
- kragen 7y agoI was pleased and surprised that the Python 3 one works with Termux on this cellphone. I've had trouble with Python socket stuff on here in the past, but now I suspect that may have been specific to IP multicast.
- slim 7y agoThe busybox one works too
- rahuldottech 7y agoNetcat ones are my favourite, I use them frequently: https://gist.github.com/willurd/5720255#gistcomment-2851087 https://gist.github.com/willurd/5720255#gistcomment-2851087 The same thing, in `batch` for Windows: https://github.com/rahuldottech/netcat-http-server-for-windows/blob/master/simple/simple.cmd https://github.com/rahuldottech/netcat-http-server-for-windo...
- 3xblah 7y agoDon't forget socat. Or tcpserver from djb .
- forgotmypw 7y agoHow many of these can output a "standard" access log? Instructions for how to do that would be a helpful addition to this page.
- kragen 7y agoThe Python one does.
- beizhia 7y agoThe Crystal version can. I just commented an update for it that will run on 0.32.1, but for logging you can include the HTTP::LogHandler: crystal eval 'require "http/server"; server = HTTP::Server.new([HTTP::LogHandler.new, HTTP::StaticFileHandler.new(".")]); server.bind_tcp(8080); server.listen'
- Svenstaro 7y agoShameless plug: https://github.com/svenstaro/miniserve/ https://github.com/svenstaro/miniserve/
- fyp 7y agoSome of these aren't one line but could be (for example the one for node.js can use npx instead)
- londons_explore 7y agoLots of people use these one liners for Dev/test environments. Most of those people aren't aware how insecure they are. For example, with the python SimpleHTTPServer I can simply request http://localhost/../../.ssh/id_rsa http://localhost/../../.ssh/id_rsa All your SSH private keys are now mine. I can steal your browser cookie database and get into your email/Facebook/Twitter in the same way. Any web page can request that, or any software on any machine on your local network.
- Thorrez 7y agoHuh? When I use SimpleHTTPServer with .. it just ignores the .. and keeps me in the same directory. Is the behavior different on different versions of python or something? Is there some special technique I don't know? I tried with '.' and with '%2e' .
- tyingq 7y agoI noticed that browsers and curl were doing something with .. on the client side. Try telnet to the port and typing the GET by hand.
- Thorrez 7y agoYou're partially right that curl is blocking '..'. But it's not blocking '%2e%2e'. I got it to avoid blocking '..' with the --path-as-is flag. I redid the tests, with curl's --path-as-is flag, as well as with raw TCP (via netcat), and SimpleHTTPServer is still not vulnerable.
- guessmyname 7y ago> For example, with the python SimpleHTTPServer I can simply request http://localhost/../../.ssh/id_rsa http://localhost/../../.ssh/id_rsa Eh! That’s not true. I just tried and both Python 2.7.16 and Python 3.7.6 return a "404 Not Found” when I try to download and existing file that is located one or more levels up from the directory where the HTTP server was started. Here is a screenshot showing both results: https://i.imgur.com/uizp7zV.png https://i.imgur.com/uizp7zV.png
- deleted 7y ago[deleted]
- scanr 7y agoAsked for an HTTPS one liner on stackoverflow a while back and got this answer: ruby -r webrick/https -e ' WEBrick::HTTPServer.new( Port: 8000, DocumentRoot: ".", SSLEnable: true, SSLCertName: [%w[CN localhost]]).start' https://stackoverflow.com/a/37986354/59325 https://stackoverflow.com/a/37986354/59325
- avip 7y agoCaddy is brilliant for this task.
- divbzero 7y agoFor reference the HTTPS one-liner with Caddy [1] would be: caddy file-server --domain example.com And similarly for HTTPS reverse proxy: caddy reverse-proxy --from example.com --to localhost:9000 [1]: https://caddyserver.com/ https://caddyserver.com/ This plus hosts file can be a quick way to test secure cookies, secure headers, etc.
- rjeli 7y agoYou could also tunnel any of the http servers through socat ssl-l.
- Ded7xSEoPKYNsDd 7y agoopenssl can also do it. no dirlisting though. openssl req -x509 -newkey rsa:4096 -keyout /tmp/key.pem -out /tmp/cert.pem -nodes && openssl s_server -WWW -port 8443 -cert /tmp/cert.pem -key /tmp/key.pem
- inconshreveable 7y agoIt's missing my personal favorite: ngrok http file:///Users/alan/share
- capableweb 7y agoYou might want to include a disclaimer that you're the author, maintainer and person behind the company that operates ngrok ;) Just wanted to chime in and say I love ngrok too, not allow allows you to easily create proxies, it allows you to create proxies that also works on the public internet (ngrok assigns you a x.ngrok.io address) and with tcp connections. Great work on it inconshreveable!
- arendtio 7y agoDoes someone know if there is a way of doing this purely with POSIX tools?
- arminiusreturns 7y agowhile TRUE; do { echo -e 'HTTP/1.1 200 OK\r\n'; cat /path/to/thing; } | nc -l 8000; done From: https://krypted.com/ https://krypted.com/
- ainar-g 7y agoNeither echo -e nor nc are POSIX. I don't think there is a strictly POSIX one-liner.
- arendtio 7y ago`echo -e` should be easily replaceable with `printf` but nc remains to be a problem.
- tyingq 7y agoIs inetd "Posix"? It has command line switches to not fork, and to specify the config file. Maybe it takes a config file of "-" to mean stdin.
- deleted 7y ago[deleted]
- arendtio 7y agoI doubt it. At least I can't find it anywere here: https://pubs.opengroup.org/onlinepubs/9699919799/utilities/contents.html https://pubs.opengroup.org/onlinepubs/9699919799/utilities/c...
- ksherlock 7y agoprintf(1) is POSIX and is a superset of echo.
- nickcw 7y agoThere is of course rclone: https://rclone.org/commands/rclone_serve_http/ https://rclone.org/commands/rclone_serve_http/ rclone serve http . You can replace . with any of your other cloud storage backends too (s3, google drive, dropbox, etc), or http with sftp, webdav, ftp, dlna. It works on Windos/macOS/Linux. (Rclone author ;-)
- kaendfinger 7y agorclone is our backup solution at work, huge props to you!
- tiltrus 7y agoRclone is a fantastic tool. Thanks!
- gravitas 7y agoI still have a copy of bash-httpd laying around, if any of y'all remember this: http://frakir.org/~morty/lue/bash-httpd.html http://frakir.org/~morty/lue/bash-httpd.html
- sondr3 7y agoUsing `nix` I have an alias called `serve` that runs `nix run nixpkgs.caddy -c caddy -host 0.0.0.0 -port 8000 browse` which will download Caddy if it is not in my cache and then run it. It's one of my favorite aliases and I use it way more frequently than I'd expect.
- tyingq 7y agoI'm pushing the definition of "one liner" here, and it's got some major shortcomings (including directory traversal!), but here's one with Gnu awk: gawk '@load "filefuncs";func send(s,e,d,t,b) {;print "HTTP/1.0 "s" "e|&S;print "Content-Length: "b|&S;print"Content-Type: "t|&S;print d|&S;close(S);}func mt(f) {;c = "file -b --mime-type " f;r="";while ((c|getline z)>0) {;r=r z;} ;close(c);return r;} ;BEGIN {RS=ORS="\r\n";while(1){;S="/inet/tcp/8080/0/0";while((S|&getline l)>0) {;split(l,f," ");if(f[1]=="GET"){p=substr(f[2],2)}if(p==""){p="index.html"}stat(p,s);if (s["type"]=="file") {;m=mt(p);while ((getline i <p)>0){o=o i}send(200,"OK",o,m,s["size"]);break;} ;n="<html>Not Found</html>";send(404,"Not Found",n,"text/html",length(n));break;}}}' edit: Added better mime-type detection and 404s. It actually sorta works well now.
- tyingq 7y agoOof. It wasn't handling binary files. Also fixed directory traversal, and you can optionally specify a content directory on the cmd line. gawk '@load"filefuncs";@load"readfile";func send(s,e,d,t,b){print"HTTP/1.0 "s" "e|&S;print"Content-Length: "b|&S;print"Content-Type: "t|&S;print d|&S;close(S);}func cf(x){split(x,y,"/");for(z in y){print "FOUND "y[z];if(y[z]==".."){return 0;}}return 1;}func mt(f){c="file -b --mime-type "f;r="";while((c|getline z)>0){r=r z;}close(c);return r;}BEGIN{if(ARGV[1]!=""){if(chdir(ARGV[1])){print "Failed to chdir to "ARGV[1];exit;}ARGC=1;}RS=ORS="\r\n";while(1){S="/inet/tcp/8080/0/0";while((S|&getline l)>0){split(l,f," ");if(f[1]=="GET"){p=substr(f[2],2)}if(p==""){p="index.html"}stat(p,s);if(cf(p)&&s["type"]=="file"){m=mt(p);o=readfile(p);send(200,"OK",o,m,s["size"]);break;}n="<html>Not Found</html>";send(404,"Not Found",n,"text/html"RS,length(n));break;}}}'
- freedomben 7y agoYou are a hero good sir or madam. Is this redistributable with attribution?
- tyingq 7y agoHeh. Sure...licensed under WTFPL. http://www.wtfpl.net/about/ http://www.wtfpl.net/about/
- anderspitman 7y agoBit of a stretch but you can also use curl if you proxy it through my patchbay.pub[0] service: curl https://patchbay.pub/abcd1234.html https://patchbay.pub/abcd1234.html --data-binary @index.html [0] https://patchbay.pub https://patchbay.pub
- severus_snape 7y agoThere is woof: http://www.home.unix-ag.org/simon/woof.html http://www.home.unix-ag.org/simon/woof.html When -U is specified, it provides an upload form, allowing file uploads.
- jmull 7y agoI've been using this: npx serve (This is a node.js thing.)
- runarberg 7y agoUnlike `python3 -m http.server`, `npx serve` doesn’t redirect `/path/to/dir` to `/path/to/dir/`. This is a problem if you are using relative paths in your `/path/to/dir/index.html`.
- jmull 7y agoFor my purposes that hasn’t been a problem. I guess I would normally just start with ‘path/to/dir/‘ or ‘/path/to/dir/index.html’
- laurent123456 7y agoI'm surprised there's no one-liner for Node without dependency since it has a server by default. Edit: Didn't know there was an `eval` flag for Node, so that will do the job: node --eval "var fs = require('fs'), http = require('http'); http.createServer(function (req, res) { fs.readFile(__dirname + req.url, function (err,data) { if (err) { res.writeHead(404); res.end(JSON.stringify(err)); return;}res.writeHead(200);res.end(data); });}).listen(8080);"
- hombre_fatal 7y agoDoesn't protect against folder climbing/traversal like `curl :8080/../../etc`.
- djsumdog 7y agoHuh .. that'd be a fun post; see how many of these can be susceptible for climbing out of their web root. The author does list which ones support dir indexes.
- pvillano 7y agohopefully you're not using a one-liner for your actual deployment. I use it for no stakes development
- hombre_fatal 7y agoCaddy is a one-liner. Plenty of the one-liners are suitable for production. There are so many solutions that you might as well use one, even in development, that doesn't have such glaring issues, because you're basically training your muscle memory to reach for it.
- laurent123456 7y agoMost of these one-liner probably aren't secure. As the title post says "Use this power wisely".
- vorticalbox 7y ago
- Minor49er 7y agophp -S localhost:8000
- divbzero 7y agoAnother good option for static site development is devd [1] [2] which can automatically open the site in browser with livereload: devd -ol . [1]: https://github.com/cortesi/devd https://github.com/cortesi/devd [2]: https://news.ycombinator.com/item?id=10436111 https://news.ycombinator.com/item?id=10436111
- teknopaul 7y agoMy favourite... apt install nginx Why settle for less.
- vorticalbox 7y agoIf you use npx http-server -p 8080 You don't need to fully install globally
- acidx 7y agoLwan (https://lwan.ws https://lwan.ws) can also be used like this, although I wouldn't call it a "one liner" like many of the examples listed there: lwan -r /path/to/files/to/serve
- deleted 7y ago[deleted]
- 3xblah 7y agorarun2 from radare2 rarun2 listen=80 program=/usr/bin/printf arg1="HTTP/1.1 200 OK\r\nContent-type=text/html\r\nConnection: close\r\n\r\n"
- PhilippGille 7y agoLike some others in this thread I'll throw in my own shameless plug for `serve`: https://github.com/philippgille/serve https://github.com/philippgille/serve It's similar to the others mentioned here, with the nice extras that there's optional basic auth, optional HTTPS with automatic creation and use of a self-signed certificate, there are installers for most popular OS's package managers (snap, homebrew, scoop, chocolatey), tiny 2-5 MB zero-dependency binary and some other features. I've had plans to add automatic Let's Encrypt certs, Onion service creation and reverse SSH functionality (either using one's own SSH server or one of the public ones) for a while and hope I'll get to them soon. Does anyone have any specific preferences for one of those or another feature specifically for the use case of serving files to another person as quickly as possible?
- exegete 7y agoLast revised in 2013 FYI.