doc: drop mentions to .pow files ($deity REST their soul)
Co-authored-by: Roberto Abdelkader Martínez Pérez <robertomartinezp@gmail.com>
This commit is contained in:
@@ -111,7 +111,7 @@ After building the image you can run the container with:
|
||||
|
||||
.. code-block:: console
|
||||
|
||||
$ docker run --rm -i -p 8080:8080 -v $(pwd)/whatever.pow:/opt/whatever.pow kapow:latest server /opt/whatever.pow
|
||||
$ docker run --rm -i -p 8080:8080 -v $(pwd)/whatever-route:/opt/whatever-route kapow:latest server /opt/whatever-route
|
||||
|
||||
With the ``-v`` parameter we map a local file into the container's filesystem so
|
||||
we can use it to configure our *Kapow!* server on startup.
|
||||
|
||||
@@ -116,10 +116,10 @@ Install *Kapow!*
|
||||
Follow the :ref:`installation instructions <installation>`.
|
||||
|
||||
|
||||
Write a :file:`ping.pow` File
|
||||
+++++++++++++++++++++++++++++
|
||||
Write an Init Program :file:`ping-route`
|
||||
+++++++++++++++++++++++++++++++++++++++
|
||||
|
||||
*Kapow!* uses plain text files (called `pow` files) where the endpoints you want
|
||||
*Kapow!* uses init programs/scripts where the endpoints you want
|
||||
to expose are defined.
|
||||
|
||||
For each endpoint, you can decide which commands get executed.
|
||||
@@ -128,11 +128,15 @@ For our example we need a file like this:
|
||||
|
||||
.. code-block:: console
|
||||
|
||||
$ cat ping.pow
|
||||
$ chmod +x ping-route
|
||||
$ cat ping-route
|
||||
#!/usr/bin/env sh
|
||||
kapow route add /ping -c 'ping -c 1 10.10.10.100 | kapow set /response/body'
|
||||
|
||||
Let's dissect this beast piece by piece:
|
||||
|
||||
#. ``#!/usr/bin/env sh`` - shebang line so that the kernel knows which
|
||||
interpreter to use
|
||||
#. ``kapow route add /ping`` - adds a new `HTTP API` endpoint at ``/ping``
|
||||
path in the *Kapow!* server. You have to use the ``GET`` method to invoke
|
||||
the endpoint.
|
||||
@@ -147,18 +151,19 @@ Let's dissect this beast piece by piece:
|
||||
Launch the Service
|
||||
++++++++++++++++++
|
||||
|
||||
At this point, we only need to launch :program:`kapow` with our :file:`ping.pow`:
|
||||
At this point, we only need to launch :program:`kapow` with our
|
||||
:file:`ping-route`:
|
||||
|
||||
.. code-block:: console
|
||||
|
||||
$ kapow server ping.pow
|
||||
$ kapow server ping-route
|
||||
|
||||
*Kapow!* can expose the user interface through HTTPS, to do this provide the
|
||||
corresponding key and certificates chain paths at startup:
|
||||
|
||||
.. code-block:: console
|
||||
|
||||
$ kapow server --keyfile path/to/keyfile --certfile path/to/certfile ping.pow
|
||||
$ kapow server --keyfile path/to/keyfile --certfile path/to/certfile ping-route
|
||||
|
||||
|
||||
Consume the Service
|
||||
|
||||
@@ -28,7 +28,8 @@ In this example, an attacker can inject arbitrary parameters to :command:`ls`.
|
||||
.. code-block:: console
|
||||
:linenos:
|
||||
|
||||
$ cat command-injection.pow
|
||||
$ cat command-injection
|
||||
#!/usr/bin/env sh
|
||||
kapow route add '/vulnerable/{value}' - <<-'EOF'
|
||||
ls $(kapow get /request/matches/value) | kapow set /response/body
|
||||
EOF
|
||||
@@ -48,7 +49,8 @@ request:
|
||||
.. code-block:: console
|
||||
:linenos:
|
||||
|
||||
$ cat command-injection.pow
|
||||
$ cat command-injection
|
||||
#!/usr/bin/env sh
|
||||
kapow route add '/not-vulnerable/{value}' - <<-'EOF'
|
||||
ls -- "$(kapow get /request/matches/value)" | kapow set /response/body
|
||||
EOF
|
||||
|
||||
Reference in New Issue
Block a user