SimpleHTTPServer: A Production-Ready File Server Hidden in Plain Sight
Hook
Python’s SimpleHTTPServer has been a quick solution for file sharing during development, but it lacks built-in support for uploads, authentication, or HTTPS. ProjectDiscovery rebuilt it in Go with security testing capabilities in mind.
Context
Developers frequently use python -m http.server to quickly share files during development or testing. It’s simple, built-in, and requires zero configuration. But adding HTTPS, implementing basic authentication, or accepting file uploads requires reaching for additional frameworks.
ProjectDiscovery built SimpleHTTPServer as a Go-based alternative that addresses these limitations. The tool isn’t just a file server—it’s a dual-mode utility that also functions as a configurable TCP server with YAML-based response templates. This makes it useful for security testing scenarios that require simulating services or hosting payloads with HTTPS support, while also serving developers who need capabilities beyond Python’s built-in version.
Technical Insight
SimpleHTTPServer provides file serving with TLS, basic authentication, CORS, and upload capabilities configured through CLI flags. The architecture is deliberately minimal with no plugin system or middleware stack.
The TLS implementation allows immediate HTTPS deployment. When you enable HTTPS without providing certificates, the tool generates self-signed certificates:
simplehttpserver -https -domain localhostThis command starts an HTTPS server with a certificate valid for localhost, enabling immediate testing of service workers, secure contexts, or HTTPS-only APIs. For production or staging, you can provide your own certificates:
simplehttpserver -https -cert ./cert.pem -key ./key.pem -listen 0.0.0.0:8443The upload feature transforms the tool from read-only to bidirectional. Enable it with -upload, and combine with -sandbox mode to restrict uploads to the served directory. You can set maximum file sizes:
simplehttpserver -upload -sandbox -max-file-size 100 -path ./uploadsThe TCP mode with YAML-based rules allows simulation of various TCP protocols by matching incoming data and returning templated responses:
simplehttpserver -tcp -rules protocol.yaml -tlsThe YAML rules engine uses pattern matching with match (regex) and match-contains (literal) fields:
rules:
- match: regex-match
match-contains: literal-match
name: rule-name
response: response dataThis enables simulation of protocols like SMTP or HTTP endpoints for testing purposes, though it evaluates each request independently without maintaining session state between exchanges.
Authentication uses HTTP Basic Auth configured through: -basic-auth user:password. The -realm flag sets the basic auth message. This provides simple credential-based protection suitable for testing and development scenarios.
The -verbose flag dumps full HTTP requests and responses for debugging. The -py flag emulates Python’s SimpleHTTPServer output format for compatibility with existing scripts.
The tool’s default listen address is specified as 127.0.0.1:8000 in the documentation, though examples show output with 0.0.0.0:8000. To explicitly expose the server to your network, specify the binding address with -listen 0.0.0.0:8000.
Gotcha
Authentication is limited to Basic Auth—there’s no token-based authentication or session management. This keeps SimpleHTTPServer in the testing and development category rather than production deployment.
The TCP server’s YAML rules engine evaluates each request independently—there’s no session state tracking or protocol-specific parsing. This works well for simple request-response patterns or basic service simulation, but complex protocol conversations requiring state management across multiple exchanges become difficult to implement with the template-based approach.
Verdict
Use SimpleHTTPServer if you’re doing security testing and need to host payloads over HTTPS with minimal setup, developing locally and need to test file uploads without writing server code, need basic authentication on a file server without configuring a full web server, or are simulating TCP protocols for testing. The TLS certificate generation makes it more capable than Python’s version for scenarios requiring secure contexts. The tool’s sweet spot is temporary testing environments, security research, and development scenarios where you need more than Python’s SimpleHTTPServer but don’t require the operational features of production-grade servers.
