HTTP exploit harness (tier5_http)¶

Exploit scenarios live in benchmarks/tier5_http/exploits/*.toml. The harness reads TOML only — do not hardcode exploit ids in Python.

Run¶

export TIER5_EXPLOIT_STUB=1   # CI: config + stub drivers, no live servers
./benchmarks/harness/exploit_http.py --profile pr
./benchmarks/harness/exploit_http.py --dry-run
./benchmarks/harness/exploit_http.py duplicate_content_length --compare-nginx

Results: benchmarks/results/exploit_report.csv (exploit_id, mitigation_id, lang, passed, …).

Nginx vs li-httpd¶

nginx is the baseline oracle (stock config from [targets].server_config bench TOML).
li-httpd may be stricter than nginx; set [expect].li_behavior = "stricter" and use --compare-nginx to record when li rejects an attack nginx accepts.

Tier F (RNG)¶

Exploit id	Injection	PR profile
`rng_constant_bytes`	`[server.rng] mode=bad` constant fill	yes
`rng_partial_fill`	`bad_pattern=partial_fill`	yes
`rng_prng_on_tls_prod`	production rejects prng+TLS	yes
`rng_prng_on_tls_dev`	dev allows with warning	nightly
`rng_repeat_iv`	`bad_pattern=repeat`	nightly
`rng_sim_schedule`	`mode=sim` + fixture schedule	nightly

Harness merges [server.rng] from exploit TOML into li-httpd config (LI_HTTPD_EXPLOIT_HARNESS=1). Nginx rows are behavioral oracles only — no BadRng inject.

Unit gate (PR when packages/li-rng/** or packages/li-tls/** changes):

./scripts/run_rng_exploits.sh
./scripts/check-rng-exploit-suite.sh

Ethics¶

Lab-only drivers (BadRng, smuggling bytes) belong in isolated CI/nightly profiles. Do not point exploit TOML at production hosts.

Gates¶

./scripts/check-tier5-exploit-harness.sh
./scripts/httpd-plan-gates.sh

Mitigation checklist: benchmarks/tier5_http/nginx_mitigations.toml — see security-nginx-src-audit.md and audit_nginx_src.py --check.

OWASP Top 10 / CWE suite (gap-exploit-owasp-cwe-suite)¶

Every enabled exploits/*.toml row carries owasp = [...] plus refs with CVE/CWE/CAPEC tokens. Tier A/B/C cover protocol, traversal, smuggling, and injection classes; F RNG; G leak censor; W weaponized (nightly). Li must be stricter-or-equal vs nginx where [expect].li_behavior = "stricter".

./scripts/check-tier5-exploit-owasp-cwe-suite.sh

Catalog: benchmarks/tier5_http/owasp_top10_map.toml.