Toolbox

Where the toolbox started

In 2020 I was working on the network access layer of a project at an insurance company: integrating with bank interfaces, turning XML messages into our internal objects, and passing them on to the insurance core system.

Skipping the business detail, my work came down to two directions: receiving messages and responding to them. The banks could not run joint debugging with us whenever we wanted, and neither could the core system, which made testing painful. Some policies only took effect the day after they were issued, so testing the later steps meant planting orders the day before.

That is when the idea of building tools was born.

• We used FreeMarker to render the XML we sent back to the banks. To iterate on FTL templates quickly I built the online FreeMarker tester, and opened it up for everyone else too.
• We used XPath to pull data out of inbound XML. To debug those expressions quickly I built the online XPath tester, and opened that one up as well.

Going closed source, for security

Before 2022 the toolbox was open source; in 2023 I closed it. Not because I was worried about people copying it — everyone copies code, and I Google other people’s code too — but for security reasons. Let me explain.

In January 2022 I found a remote code execution hole in my own FreeMarker tester: passing freemarker.template.utility.Execute ran arbitrary code. That is as bad as it gets — a back door on the server, wide open. Luckily everything ran inside Docker, so the host was not lost with it.

In July 2022 I found another one in the Dig lookup tool: when a domain’s NS record points at an attacker’s own server, the query leaks my server’s real origin IP. Once the origin is known, an attacker can bypass my WAF and hit the server directly.

So I closed the source and restructured: risky commands run on a second host, whose services I rewrote in Go instead of the original Java, which is also faster.

To every geek and security researcher out there: I am not a security professional, just a regular developer. If you find a hole, please go easy on me and get in touch — I will thank you publicly on this site.