parlov 0.8.0

HTTP oracle detection tool — systematic probing for RFC-compliant information leakage.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49

//! Demo server for the parlov CLI showcase.
//!
//! Starts the RFC-compliant elicitation server and blocks until Ctrl-C.
//! Run with: `cargo run --example demo_server --features demo [-- --port 8080]`

#![deny(clippy::all)]
#![warn(clippy::pedantic)]

use clap::Parser;
use parlov::demo;

/// Launch the parlov elicitation demo server.
#[derive(Debug, Parser)]
struct Args {
    /// Port to listen on.
    #[arg(long, default_value_t = 8080)]
    port: u16,
}

#[tokio::main]
async fn main() {
    let args = Args::parse();
    let addr = demo::spawn_on(args.port).await;

    println!("parlov demo server listening on http://{addr}");
    println!();
    println!("Routes:");
    println!("  PATCH/PUT       /state/{{id}}       → 409/404  (state-transition-elicit)");
    println!("  POST/PUT        /unique/{{id}}      → 409/404  (uniqueness-elicit)");
    println!("  DELETE          /dependent/{{id}}   → 409/404  (dependency-delete-elicit)");
    println!("  GET/HEAD        /ratelimited/{{id}} → 429/404  (rate-limit-burst-elicit)");
    println!("  GET/HEAD        /headered/{{id}}    → 200+hdrs/404 (rate-limit-headers-elicit)");
    println!("  GET/HEAD        /forbidden/{{id}}   → 403/404  (low-privilege-elicit)");
    println!("  GET/HEAD        /scoped/{{id}}      → 200/403/404 (scope-manipulation-elicit)");
    println!();
    println!("Known IDs: {}", demo::KNOWN_IDS.join(", "));
    println!();
    println!("Example:");
    println!("  parlov scan --target \"http://{addr}/state/{{id}}\" \\");
    println!("    --baseline-id 42 --probe-id 9999 \\");
    println!("    --risk method-destructive \\");
    println!("    --state-field \"status=invalid_state\"");

    tokio::signal::ctrl_c()
        .await
        .expect("failed to listen for ctrl-c");

    println!("\nshutting down.");
}