3

I took my laptop to a local restaurant yesterday to do some work setting up a new web app. I get the server in place, and created a simple HTML page:

<html>
    <body>Hello, world.</body>
</html>

I start the server (Jersey), and then issue the following command to make sure everything is working properly:

curl http://localhost:8080/assets/index.html

Imagine my surprise when instead of my simple document I see the following returned:

<html lang="en" xml:lang="en"><!PAGEREF 1>
<head><title>Eguide</title>
<script type="text/javascript" src="/all/rootscript.js"></script>
<script type="text/javascript" src="/cobrandscript.js"></script>

</head>
<!--
/yp/home.htm
<a href="http://webmailtest.bellsouth.net" target=_top>Webmail test</a>
v. 2.8b srv24
-->
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<meta http-equiv="refresh" content="0;URL=http://home.bellsouth.net">
</head>
<body>
</body>
</html>
<html>
    <body>Hello, world.</body>
</html>

My document is there at the bottom, but before that there is a mess of code that has somehow been injected. My first thought was to grep my system for some of the strings contained in the resultant HTML (e.g. grep -ri cobrandscript run from the root directory) . There were no files on my system that were suspect. So, I turn off my wifi and issue the same curl command. This time, my 3-line HTML document is then returned, without any of the additions.

It appears that the ISP is injecting HTML into an HTML document which is being served from localhost.

My question is: how is this possible? This is content being served by localhost; this implies that a request to localhost is in fact hitting the outside network, at least when connected, and that behavior seems grossly incorrect to me.

jchilders
  • 143
  • 3

1 Answers1

3

It sounds like you're using a proxy server. Even if you're accessing localhost, if you haven't configured your proxy settings to ignore localhost, it'll be routed through the proxy. You may not have configured any proxy, it may just be a part of the network configuration distributed by whatever network you're connecting to.

use curl --noproxy localhost, http://localhost:8080/assets/index.html

austinian
  • 1,699
  • 2
  • 15
  • 29
  • Marking as answered, although the problem went away by itself for me. Still was interesting to see. – jchilders Aug 19 '14 at 22:01
  • It worked for me, however, without the `localhost,` part after `--noproxy`. – Gustavo Straube Oct 27 '15 at 00:20
  • The host list part, `localhost,` in this case, is optional, but [the documentation](http://curl.haxx.se/docs/manpage.html) doesn't specify the behavior in this case. – austinian Oct 27 '15 at 22:58