BurnerNet

Zero-trust, anti-forensic HTTP client. Wipes secrets. Severs traces. CPR in a Stealth Tank. 👻

BurnerNet is a C++20 anti-forensic HTTP client. It provides a fluent, CPR-like API for apps that cannot fully trust the local machine—physically wiping secrets from RAM and severing execution traces to hide your logic from scanners and debuggers.

It offers familiar host-compatible defaults for ordinary HTTP and an explicit Hardened profile for hostile environments. Both paths favor short-lived clients; advanced trust remains application-owned.

Looking to protect the payloads downloaded by BurnerNet? Check out RipStop Codec for in-memory asset descrambling.

Principles • Getting Started • Integration Paths • Security Reality

At a Glance

Area	BurnerNet
Language	C++20
Platform	Windows x64/x86 (First-Class), Linux (Verified)
Transport	libcurl-backed HTTP(S)
Memory hygiene	Secure wiping utilities and wiping allocators
Forensic hygiene	Automated heap/stack scrubbing across BurnerNet-managed transport state
Dynamic Analysis	Call stack isolation can sever the link between consumer and transport
Build hardening	Optional diagnostic-string removal, obfuscated literals, reduced C++ runtime metadata in hardened builds
Runtime hardening	DoH support, provider-based secrets, and stricter trust controls
Integration	CMake or Visual Studio source-drop

Why Use It

Use BurnerNet when a normal HTTP client is too trusting for your environment.

It helps when you want to:

• keep request clients short-lived instead of sharing one global transport
• reduce reliance on local DNS and other host defaults
• fetch tokens, certs, and verification secrets only when needed
• keep response verification logic in your own application code
• reduce obvious plaintext strings and metadata in hardened builds

Who It's For

BurnerNet fits projects such as:

• Windows desktop apps with high-value auth, licensing, or update requests
• embedded or injected code running in a host you do not fully trust
• tools that want stricter transport checks without giving up a fluent C++ API

Standard Stack vs BurnerNet

Concern	Typical HTTP stack	BurnerNet
Client lifetime	Often shared and long-lived	Designed for disposable clients and burst-scope use
Sensitive values	Secrets often sit in config or memory longer than needed	Provider callbacks fetch them close to use
DNS and trust	Usually inherits local resolver and host defaults	Supports stricter trust controls including DoH fallback and pinned keys
Verification	App-specific integrity checks are often bolted on later	Built to work with pre-flight, transport, and response verification hooks

Defensive Outcomes

• Zero-Ghost Memory Architecture: BurnerNet uses a custom Prefix-Size Scrubber to hook the internal memory allocation paths of libcurl and OpenSSL-backed flows. Sensitive transport buffers are wiped as they leave BurnerNet-managed lifetime. This hygiene is verified on both Windows and Linux within the audited configurations described in the docs.
• Stack-Frame Swiping: After every request, the library proactively scrubs its own thread stack (High-Water Mark scrubbing). This is intended to destroy ephemeral transport fragments before control returns to your application.
• Moving-Target Heap: The combination of disposable transports and aligned metadata headers creates high address-space dispersion, making the process memory unpredictable and resistant to stable pointer-mapping.
• Short-lived request state: BurnerNet is designed around disposable clients instead of process-wide singleton transports.
• Less trust in the host: DoH support, pinned-key support, and transport auditing help reduce dependence on compromised local defaults.
• Lower plaintext exposure: Provider callbacks and secure wiping utilities reduce the lifetime of certs, keys, tokens, and other sensitive buffers.
• App-owned verification: Response verification stays in your code through WithResponseVerifier(...) instead of being hardcoded into a shared library.
• Harder static fingerprinting: hardened builds can set BURNERNET_DIAGNOSTIC_STRINGS=0 so ErrorCodeToString(...) returns stable E<number> values without embedding symbolic error names.
• Import-light deployment options: BURNERNET_HARDEN_IMPORTS=1 can resolve runtime dependencies dynamically instead of advertising them directly in the import table, using BurnerNet's KernelResolver path on Windows.
• Call Stack Isolation (Async Handoff): When enabled via .WithStackIsolation(true), the library executes the transport lifecycle on a detached worker thread. This can physically sever the caller's call stack and reduce direct top-down tracing of application logic.

Verified Stealth

BurnerNet does not just claim an import-light hardened mode; it also ships with audit notes for specific tested configurations. In a Windows x64 Release audit with BURNERNET_HARDEN_IMPORTS=ON:

• IAT Blackout: No entries for libcurl.dll, ws2_32.dll, bcrypt.dll, or crypt32.dll were observed in the audited binary.
• Memory Dark-out: Forensic scans (Cheat Engine "All Strings") failed to discover sensitive canary URLs or headers in the process heap or stack.
• Debugger Blindness: Integrated tests verify that the library triggers an "Identity Shift." The Decision-Maker (your app) and the Transporter (BurnerNet) operate on distinct Thread IDs, reducing top-down tracing during live debugging sessions.
• Noise-to-Signal: The library aims for forensic hygiene within its wipe authority, while acknowledging remaining system-level "shadows" in the OS and runtime environment.

Audit details and methodology:

• docs/BINARY_STEALTH_AUDIT.md

Getting Started

Fastest path:

• Add BurnerNet to your build with CMake or Visual Studio source-drop.
• Include <burner/net.h>.
• Create a stack client, send a request, then let it leave scope.

Minimal example:

#include <iostream>

#include <burner/net.h>

int main() {
    burner::net::Client client;
    if (!client.IsReady()) {
        std::cerr << burner::net::ErrorCodeToString(client.InitError()) << '\n';
        return 1;
    }

    const auto response = client
        .Get("https://example.com")
        .WithHeader("Accept", "text/html")
        .WithTimeoutSeconds(10)
        .Send();

    if (!response.TransportOk()) {
        std::cerr << burner::net::ErrorCodeToString(response.transport_error) << '\n';
        return 1;
    }

    std::cout << "HTTP " << response.status_code << '\n';
    return 0;
}

Client uses Standard defaults: system CA, DNS, and proxy with TLS peer and hostname verification enabled. WithCasualDefaults() remains available as a Standard compatibility alias.

For security-critical traffic, use the Hardened profile. Build() rejects missing controls before any request:

auto secure = burner::net::ClientBuilder(burner::net::ClientProfile::Hardened)
    .WithMtlsProvider(ProvideMtlsCredentials)
    .WithSecurityPolicy(AppSecurityPolicy{})
    .WithDnsFallback(burner::net::DnsMode::Doh,
                     "https://resolver.example/dns-query",
                     "Primary DoH")
    .AllowSystemDns(true) // explicit fallback, after DoH
    .WithResponseVerifier(VerifySignedResponse)
    .Build();