A comprehensive HTML file enumerating all possible ways a website can leak HTTP requests for security testing.
HTTPLeaks is a security research project that enumerates all possible ways a website can leak HTTP requests through HTML elements and attributes. It provides a single HTML file containing every known method for unintended request exfiltration, helping developers and security professionals test for vulnerabilities. The project addresses scenarios where web applications, email clients, or proxies inadvertently send requests to external resources, compromising privacy and security.
Security researchers, web developers, and privacy advocates who need to test browsers, web applications, email clients, or anonymization tools for HTTP leak vulnerabilities.
HTTPLeaks offers the most comprehensive and up-to-date collection of HTTP leak vectors in one easily accessible file, making it an essential tool for proactive security testing and privacy auditing where other tools may miss obscure or newly discovered leaks.
HTTPLeaks - All possible ways, a website can leak HTTP requests
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Aggregates every known HTML element and attribute that can trigger external HTTP requests into a single file, as explicitly stated in the README to 'enumerate all possible ways.'
Helps identify CSP bypasses and HTTP leaks in web applications, making it a critical tool for proactive security audits where overlooked leaks can compromise data.
Useful for evaluating web proxies, email clients, and anonymization tools for unintended data exfiltration, addressing real-world privacy concerns in scenarios like HTML email reading.
Continuously updated with new leak vectors from the security community, ensuring it stays relevant with emerging threats, as noted in the acknowledgments and pull request welcome.
Requires users to manually load the HTML file and interpret results using browser developer tools, lacking automation or integrated analysis features for scalable testing.
Does not provide guidance on fixing leaks; users must have security knowledge to understand findings and implement fixes, which can be a barrier for beginners.
Focuses solely on HTTP leaks through HTML elements, missing other vulnerability types like JavaScript-based exploits or network-level attacks, which requires complementary tools.