File manager

File manager - Edit - /usr/share/nmap/scripts/http-security-headers.nse

Back
local http = require "http" local shortport = require "shortport" local stdnse = require "stdnse" local table = require "table" local string = require "string" description = [[ Checks for the HTTP response headers related to security given in OWASP Secure Headers Project and gives a brief description of the header and its configuration value. The script requests the server for the header with http.head and parses it to list headers founds with their configurations. The script checks for HSTS(HTTP Strict Transport Security), HPKP(HTTP Public Key Pins), X-Frame-Options, X-XSS-Protection, X-Content-Type-Options, Content-Security-Policy, X-Permitted-Cross-Domain-Policies, Set-Cookie, Expect-CT, Cache-Control, Pragma and Expires. References: https://www.owasp.org/index.php/OWASP_Secure_Headers_Project https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers ]] --- -- @usage -- nmap -p <port> --script http-security-headers <target> -- -- @output -- 80/tcp open http syn-ack -- \| http-security-headers: -- \| Strict_Transport_Security: -- \| Header: Strict-Transport-Security: max-age=15552000; preload -- \| Public_Key_Pins_Report_Only: -- \| Header: Public-Key-Pins-Report-Only: max-age=500; pin-sha256="WoiWRyIOVNa9ihaBciRSC7XHjliYS9VwUGOIud4PB18="; pin-sha256="r/mIkG3eEpVdm+u/ko/cwxzOMo1bk4TyHIlByibiA5E="; pin-sha256="q4PO2G2cbkZhZ82+JgmRUyGMoAeozA+BSXVXQWB8XWQ="; report-uri="http://reports.fb.com/hpkp/" -- \| X_Frame_Options: -- \| Header: X-Frame-Options: DENY -- \| Description: The browser must not display this content in any frame. -- \| X_XSS_Protection: -- \| Header: X-XSS-Protection: 0 -- \| Description: The XSS filter is disabled. -- \| X_Content_Type_Options: -- \| Header: X-Content-Type-Options: nosniff -- \| Will prevent the browser from MIME-sniffing a response away from the declared content-type. -- \| Content-Security-Policy: -- \| Header: Content-Security-Policy: script-src 'self' -- \| Description: Loading policy for all resources type in case of a resource type dedicated directive is not defined (fallback). -- \| X-Permitted-Cross-Domain-Policies: -- \| Header: X-Permitted-Cross-Domain-Policies: none -- \| Description : No policy files are allowed anywhere on the target server, including this master policy file. -- \| Cache_Control: -- \| Header: Cache-Control: private, no-cache, no-store, must-revalidate -- \| Pragma: -- \| Header: Pragma: no-cache -- \| Expires: -- \|_ Header: Expires: Sat, 01 Jan 2000 00:00:00 GMT -- -- -- @xmloutput -- <table key="Strict_Transport_Policy"> -- <elem>Header: Strict-Transport-Security: max-age=31536000</elem> -- </table> -- <table key="Public_Key_Pins_Report_Only"> -- <elem>Header: Public-Key-Pins-Report-Only: pin-sha256="d6qzRu9zOECb90Uez27xWltNsj0e1Md7GkYYkVoZWmM="; report-uri="http://example.com/pkp-report"; max-age=10000; includeSubDomains</elem> -- </table> -- <table key="X_Frame_Options"> -- <elem>Header: X-Frame-Options: DENY</elem> -- <elem>Description: The browser must not display this content in any frame.</elem> -- </table> -- <table key="X-XSS-Protection"> -- <elem>Header: X-XSS-Protection: 1; mode=block</elem> -- <elem>Description: Rather than sanitize the page, when a XSS attack is detected, the browser will prevent rendering of the page.</elem> -- </table> -- <table key="X_Content_Type_Options"> -- <elem>Header: X-Content-Type-Options: nosniff</elem> -- <elem>Description: Will prevent the browser from MIME-sniffing a response away from the declared content-type.</elem> -- </table> -- <table key="Content_Security_Policy"> -- <elem>Header: Content-Security-Policy: script-src 'self'</elem> -- <elem>Description: Loading policy for all resources type in case of a resource type dedicated directive is not defined (fallback).</elem> -- </table> -- <table key="X_Permitted_Cross_Domain_Policies"> -- <elem>Header: X-Permitted-Cross-Domain-Policies: none</elem> -- <elem>Description: No policy files are allowed anywhere on the target server, including this master policy file.</elem> -- </table> -- <table key="Cache_Control"> -- <elem>Header: Cache-Control: private, no-cache, no-store, must-revalidate</elem> -- </table> -- <table key="Pragma"> -- <elem>Header: Pragma: no-cache</elem -- </table> -- <table key="Expires"> -- <elem>Header: Expires: Sat, 01 Jan 2000 00:00:00 GMT</elem -- </table> -- -- @args http-security-headers.path The URL path to request. The default path is "/". --- author = {"Icaro Torres", "Vinamra Bhatia"} license = "Same as Nmap--See https://nmap.org/book/man-legal.html" categories = {"discovery", "safe"} portrule = shortport.port_or_service({80,443}, "http", "tcp") local function fail (err) return stdnse.format_output(false, err) end action = function(host, port) local path = stdnse.get_script_args(SCRIPT_NAME .. ".path") or "/" local response local output_info = {} local hsts_header local hpkp_header local xframe_header local x_xss_header local x_content_type_header local csp_header local x_cross_domain_header local cookie local req_opt = {redirect_ok=function(host,port) local c = 2 return function(uri) if ( c==0 ) then return false end c = c - 1 return true end end} response = http.head(host, port, path, req_opt) output_info = stdnse.output_table() if response == nil then return fail("Request failed") end if response.header == nil then return fail("Response didn't include a proper header") end if response.header['strict-transport-security'] then output_info.Strict_Transport_Security = {} table.insert(output_info.Strict_Transport_Security, "Header: Strict-Transport-Security: " .. response.header['strict-transport-security']) elseif shortport.ssl(host,port) then output_info.Strict_Transport_Security = {} table.insert(output_info.Strict_Transport_Security, "HSTS not configured in HTTPS Server") end if response.header['public-key-pins-report-only'] then output_info.Public_Key_Pins_Report_Only = {} table.insert(output_info.Public_Key_Pins_Report_Only, "Header: Public-Key-Pins-Report-Only: " .. response.header['public-key-pins-report-only']) end if response.header['x-frame-options'] then output_info.X_Frame_Options = {} table.insert(output_info.X_Frame_Options, "Header: X-Frame-Options: " .. response.header['x-frame-options']) xframe_header = string.lower(response.header['x-frame-options']) if string.match(xframe_header,'deny') then table.insert(output_info.X_Frame_Options, "Description: The browser must not display this content in any frame.") elseif string.match(xframe_header,'sameorigin') then table.insert(output_info.X_Frame_Options, "Description: The browser must not display this content in any frame from a page of different origin than the content itself.") elseif string.match(xframe_header,'allow.from') then table.insert(output_info.X_Frame_Options, "Description: The browser must not display this content in a frame from any page with a top-level browsing context of different origin than the specified origin.") end end if response.header['x-xss-protection'] then output_info.X_XSS_Protection = {} table.insert(output_info.X_XSS_Protection, "Header: X-XSS-Protection: " .. response.header['x-xss-protection']) x_xss_header = string.lower(response.header['x-xss-protection']) if string.match(x_xss_header,'block') then table.insert(output_info.X_XSS_Protection, "Description: The browser will prevent the rendering of the page when XSS is detected.") elseif string.match(x_xss_header,'report') then table.insert(output_info.X_XSS_Protection, "Description: The browser will sanitize the page and report the violation if XSS is detected.") elseif string.match(x_xss_header,'0') then table.insert(output_info.X_XSS_Protection, "Description: The XSS filter is disabled.") end end if response.header['x-content-type-options'] then output_info.X_Content_Type_Options = {} table.insert(output_info.X_Content_Type_Options, "Header: X-Content-Type-Options: " .. response.header['x-content-type-options']) x_content_type_header = string.lower(response.header['x-content-type-options']) if string.match(x_content_type_header,'nosniff') then table.insert(output_info.X_Content_Type_Options, "Description: Will prevent the browser from MIME-sniffing a response away from the declared content-type. ") end end if response.header['content-security-policy'] then output_info.Content_Security_Policy = {} table.insert(output_info.Content_Security_Policy, "Header: Content-Security-Policy: " .. response.header['content-security-policy']) csp_header = string.lower(response.header['content-security-policy']) if string.match(csp_header,'base.uri') then table.insert(output_info.Content_Security_Policy, "Description: Define the base uri for relative uri.") end if string.match(csp_header,'default.src') then table.insert(output_info.Content_Security_Policy, "Description: Define loading policy for all resources type in case of a resource type dedicated directive is not defined (fallback).") end if string.match(csp_header,'script.src') then table.insert(output_info.Content_Security_Policy, "Description: Define which scripts the protected resource can execute.") end if string.match(csp_header,'object.src') then table.insert(output_info.Content_Security_Policy, "Description: Define from where the protected resource can load plugins.") end if string.match(csp_header,'style.src') then table.insert(output_info.Content_Security_Policy, "Description: Define which styles (CSS) the user applies to the protected resource.") end if string.match(csp_header,'img.src') then table.insert(output_info.Content_Security_Policy, "Description: Define from where the protected resource can load images.") end if string.match(csp_header,'media.src') then table.insert(output_info.Content_Security_Policy, "Description: Define from where the protected resource can load video and audio.") end if string.match(csp_header,'frame.src') then table.insert(output_info.Content_Security_Policy, "Description: Deprecated and replaced by child-src. Define from where the protected resource can embed frames.") end if string.match(csp_header,'child.src') then table.insert(output_info.Content_Security_Policy, "Description: Define from where the protected resource can embed frames.") end if string.match(csp_header,'frame.ancestors') then table.insert(output_info.Content_Security_Policy, "Description: Define from where the protected resource can be embedded in frames.") end if string.match(csp_header,'font.src') then table.insert(output_info.Content_Security_Policy, "Description: Define from where the protected resource can load fonts.") end if string.match(csp_header,'connect.src') then table.insert(output_info.Content_Security_Policy, "Description: Define which URIs the protected resource can load using script interfaces.") end if string.match(csp_header,'mailfest.src') then table.insert(output_info.Content_Security_Policy, "Description: Define from where the protected resource can load manifest.") end if string.match(csp_header,'form.action') then table.insert(output_info.Content_Security_Policy, "Description: Define which URIs can be used as the action of HTML form elements.") end if string.match(csp_header,'sandbox') then table.insert(output_info.Content_Security_Policy, "Description: Specifies an HTML sandbox policy that the user agent applies to the protected resource.") end if string.match(csp_header,'script.nonce') then table.insert(output_info.Content_Security_Policy, "Description: Define script execution by requiring the presence of the specified nonce on script elements.") end if string.match(csp_header,'plugin.types') then table.insert(output_info.Content_Security_Policy, "Description: Define the set of plugins that can be invoked by the protected resource by limiting the types of resources that can be embedded.") end if string.match(csp_header,'reflected.xss') then table.insert(output_info.Content_Security_Policy, "Description: Instructs a user agent to activate or deactivate any heuristics used to filter or block reflected cross-site scripting attacks, equivalent to the effects of the non-standard X-XSS-Protection header.") end if string.match(csp_header,'block.all.mixed.content') then table.insert(output_info.Content_Security_Policy, "Description: Prevent user agent from loading mixed content.") end if string.match(csp_header,'upgrade.insecure.requests') then table.insert(output_info.Content_Security_Policy, "Description: Instructs user agent to download insecure resources using HTTPS.") end if string.match(csp_header,'referrer') then table.insert(output_info.Content_Security_Policy, "Description: Define information user agent must send in Referer header.") end if string.match(csp_header,'report.uri') then table.insert(output_info.Content_Security_Policy, "Description: Specifies a URI to which the user agent sends reports about policy violation.") end if string.match(csp_header,'report.to') then table.insert(output_info.Content_Security_Policy, "Description: Specifies a group (defined in Report-To header) to which the user agent sends reports about policy violation. ") end end if response.header['x-permitted-cross-domain-policies'] then output_info.X_Permitted_Cross_Domain_Policies = {} table.insert(output_info.X_Permitted_Cross_Domain_Policies, "Header: X-Permitted-Cross-Domain-Policies: " .. response.header['x-permitted-cross-domain-policies']) x_cross_domain_header = string.lower(response.header['x-permitted-cross-domain-policies']) if string.match(x_cross_domain_header,'none') then table.insert(output_info.X_Permitted_Cross_Domain_Policies, "Description: No policy files are allowed anywhere on the target server, including this master policy file. ") elseif string.match(x_cross_domain_header,'master.only') then table.insert(output_info.X_Permitted_Cross_Domain_Policies, "Description: Only this master policy file is allowed. ") elseif string.match(x_cross_domain_header,'by.content.type') then table.insert(output_info.X_Permitted_Cross_Domain_Policies, "Description: Define which scripts the protected resource can execute.") elseif string.match(x_cross_domain_header,'all') then table.insert(output_info.X_Permitted_Cross_Domain_Policies, "Description: All policy files on this target domain are allowed.") end end if response.header['set-cookie'] then cookie = string.lower(response.header['set-cookie']) if string.match(cookie,'secure') and shortport.ssl(host,port) then output_info.Cookie = {} table.insert(output_info.Cookie, "Cookies are secured with Secure Flag in HTTPS Connection") end end if response.header['expect-ct'] then output_info.Expect_CT = {} table.insert(output_info.Expect_CT, "Header: Expect-CT: " .. response.header['expect-ct']) end if response.header['cache-control'] then output_info.Cache_Control = {} table.insert(output_info.Cache_Control, "Header: Cache-Control: " .. response.header['cache-control']) end if response.header['pragma'] then output_info.Pragma = {} table.insert(output_info.Pragma, "Header: Pragma: " .. response.header['pragma']) end if response.header['expires'] then output_info.Expires = {} table.insert(output_info.Expires, "Header: Expires: " .. response.header['expires']) end return output_info, stdnse.format_output(true, output_info) end

| ver. 1.4 | Github | . | PHP 7.4.33 | Generation time: 0.59 | proxy | phpinfo | Settings