diff --git a/badtests.py b/badtests.py index f4f6b73..cf2de8b 100644 --- a/badtests.py +++ b/badtests.py @@ -567,22 +567,22 @@ add('MIME Types',navigator.mimeTypes.length); LOGS_STYLE = ''' ☠ badtests — visitor logs

☠ visitor logs

-

Recording all requests. %d entries so far. Refresh | Home

+

Recording all requests. {count} entries so far. Refresh | Home

-%s +{rows}
TimeIPMethodPathUser-AgentHeaders
''' # --- MIME sniff test page (wraps the payload endpoint) --- @@ -600,6 +600,12 @@ class Handler(http.server.BaseHTTPRequestHandler): _index = build_index() _routes = {t[0]: t for t in TESTS} + def _get_client_ip(self): + '''Get real client IP from reverse proxy headers, fallback to socket address.''' + return (self.headers.get('X-Real-IP') + or (self.headers.get('X-Forwarded-For', '').split(',')[0].strip()) + or self.client_address[0]) + def do_GET(self): p = self.path.split('?')[0] self._log_visit() @@ -626,7 +632,7 @@ class Handler(http.server.BaseHTTPRequestHandler): headers[k] = self.headers[k] entry = { 'time': time.strftime('%Y-%m-%d %H:%M:%S'), - 'ip': self.client_address[0], + 'ip': self._get_client_ip(), 'method': self.command, 'path': self.path, 'ua': self.headers.get('User-Agent', ''), @@ -649,7 +655,7 @@ class Handler(http.server.BaseHTTPRequestHandler): {html.escape(e['ua'][:80])}
{len(e['headers'])} headers
{html.escape(hdrs_str)}
''' - page = (LOGS_STYLE % (len(VISITOR_LOG), rows)).encode() + page = LOGS_STYLE.format(count=len(VISITOR_LOG), rows=rows).encode() self._r(200, {'Content-Type': 'text/html; charset=utf-8'}, page) def _dispatch(self, path): @@ -836,11 +842,11 @@ document.querySelector('text:last-of-type').textContent = 'JS EXECUTED SUCCESSFU }, b'

HSTS Bomb

Your browser now thinks this site requires HTTPS for 31 years.

This header also applies to ALL subdomains and requests preload list inclusion.

To undo in Chrome: chrome://net-internals/#hsts

') # --- Misc --- elif p == '/misc-ipv4': - ip = self.client_address[0] + ip = self._get_client_ip() body = f'Your IP: {ip}

{ip}

' self._r(200, {'Content-Type': 'text/html'}, body.encode()) elif p == '/misc-ipv6': - ip = self.client_address[0] + ip = self._get_client_ip() body = f'Your IP: {ip}

{ip}

For true IPv6, connect to [::1]:{PORT}

' self._r(200, {'Content-Type': 'text/html'}, body.encode()) elif p == '/fingerprint':