Preamble

Sometimes we need a simple web server, public to the internet to perform some miscellaneous tasks, or to host some files when needed. However, as a “poor” dev/pentester, having a visa card to register for free cloud of Google, AWS, Oracle is sometimes a big problem. Just kidding, in this article I will introduce Deta – a tool that allows you to quickly create a micro-website/API and publish it to the internet. Here we go~

Deta

https://deta.sh is a free personal Cloud tool that allows us to build applications, prototypes and then publish to the internet quickly.

Deta comes with:

• Deta Base : NoSQL database (same as MongoDB)
• Deta Micros : Allows you to deploy your application to the internet (like Heroku). Deta lets you create as many micros as you want
• Deta Drive : Allows file storage (same as Google Drive and AWS S3)

Deta currently supports the following languages: Python , Node.js , and Golang . For each language, Deta also supports micro-frameworks such as Python’s FastAPI or Flask .

As an example, I will build a simple application for pentester as follows:

1. Allows uploading files by arbitrary URL and MIME Type. For example: access the link: ” https://myfakeserver.com/aaa.png ” but return the content as alert(origin) and the mime type is javascript (not an image file like PNG).
2. Let the user directly fill in the file content.
3. Allows deleting files.

Setting

All user manuals (complete and detailed) are available at https://docs.deta.sh/docs/home

First of all, we need to register an account. The management screen is located at: https://web.deta.sh/home

Then we download the Deta CLI and log in:

then create a new micro with python framework:

Check out the newly created file:

Right at this step we can run deta deploy and our app will be deployed to the URL above. Too fast too dangerous:

We can also install additional libraries, create a requirements.txt file and enter the names of the libraries, here we will need Flask and Deta.

Every time you fix the code, remember to deta deploy to push the code up

Backend

Modify the main.py file as follows, because the code is also quite short with 88 lines and simple, so I will not go into each step but just explain some important positions.

In this paragraph we need to create Project Keys (similar to API key) in the interface below, drive and db are objects that help us interact with the database and drive:

The route part, we will create a route to catch all (catch all requests) and then check:

• If path index => go to upload page.
• If it’s path delete => go to file delete page
• Otherwise, the default is to process and return file content (if any exist).

Deta has also provided us with methods to interact with the DB:

Used to insert a record into the DB. We will save the path (to check if there are duplicates), filename is randomly generated by uuid , mime entered by the user or taken from the uploaded file. The data in the DB will have the following form:

used to retrieve data, can query exactly or follow a syntax close to MongoDB: https://docs.deta.sh/docs/base/queries .

Used to delete files based on key. You can also interact directly through the interface at https://web.deta.sh/home:

Very simple, right? Interacting with Drive is also quite similar:

Drive also has an intuitive interface:

Frontend

No colors, flowers, pure HTML interface, no CSS