From 3d9f22e2f95ca2c12883400d9c2d7fed3fb3063c Mon Sep 17 00:00:00 2001 From: vinamra Date: Wed, 7 Jun 2017 16:21:58 +0000 Subject: [PATCH] Removes configuration line in http-security-headers --- scripts/http-security-headers.nse | 41 +++++-------------------------- 1 file changed, 6 insertions(+), 35 deletions(-) diff --git a/scripts/http-security-headers.nse b/scripts/http-security-headers.nse index acd2114ce..27623f90f 100755 --- a/scripts/http-security-headers.nse +++ b/scripts/http-security-headers.nse @@ -5,8 +5,8 @@ local table = require "table" local string = require "string" description = [[ -Checks for the HTTP response headers related to security given in OWASP Secure Headers Project, -shows whether they are configured and gives a brief description of the header and its configuration value. +Checks for the HTTP response headers related to security given in OWASP Secure Headers Project +and gives a brief description of the header and its configuration value. The script requests the server for the header with http.head and parses it to list headers founds with their configurations. The script checks for HSTS(HTTP Strict Transport Security), HPKP(HTTP Public Key Pins), @@ -26,84 +26,66 @@ https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers -- 80/tcp open http syn-ack -- | http-security-headers: -- | Strict_Transport_Security: --- | HSTS is configured. -- | Header: Strict-Transport-Security: max-age=15552000; preload -- | Public_Key_Pins_Report_Only: --- | HPKP is configured. -- | Header: Public-Key-Pins-Report-Only: max-age=500; pin-sha256="WoiWRyIOVNa9ihaBciRSC7XHjliYS9VwUGOIud4PB18="; pin-sha256="r/mIkG3eEpVdm+u/ko/cwxzOMo1bk4TyHIlByibiA5E="; pin-sha256="q4PO2G2cbkZhZ82+JgmRUyGMoAeozA+BSXVXQWB8XWQ="; report-uri="http://reports.fb.com/hpkp/" -- | X_Frame_Options: --- | X-Frame-Options is configured. -- | Header: X-Frame-Options: DENY -- | Description: The browser must not display this content in any frame. -- | X_XSS_Protection: --- | X-XSS-Protection is configured. -- | Header: X-XSS-Protection: 0 -- | Description: The XSS filter is disabled. -- | X_Content_Type_Options: --- | X-Content-Type-Options is configured. -- | Header: X-Content-Type-Options: nosniff -- | Will prevent the browser from MIME-sniffing a response away from the declared content-type. --- | Content-Security-Policy is configured. +-- | Content-Security-Policy: -- | Header: Content-Security-Policy: script-src 'self' -- | Description: Loading policy for all resources type in case of a resource type dedicated directive is not defined (fallback). --- | X-Permitted-Cross-Domain-Policies are configured. +-- | X-Permitted-Cross-Domain-Policies: -- | Header: X-Permitted-Cross-Domain-Policies: none -- | Description : No policy files are allowed anywhere on the target server, including this master policy file. -- | Cache_Control: --- | Cache-Control is configured. -- | Header: Cache-Control: private, no-cache, no-store, must-revalidate -- | Pragma: --- | Pragma is configured. -- | Header: Pragma: no-cache -- | Expires: --- | Expires is configured. -- |_ Header: Expires: Sat, 01 Jan 2000 00:00:00 GMT -- -- -- @xmloutput -- --- HSTS is configured -- Header: Strict-Transport-Security: max-age=31536000 --
-- --- HPKP is configured -- Header: Public-Key-Pins-Report-Only: pin-sha256="d6qzRu9zOECb90Uez27xWltNsj0e1Md7GkYYkVoZWmM="; report-uri="http://example.com/pkp-report"; max-age=10000; includeSubDomains --
-- --- X-Frame-Options is configured -- Header: X-Frame-Options: DENY -- Description: The browser must not display this content in any frame. --
-- --- X-XSS-Protection is configured -- Header: X-XSS-Protection: 1; mode=block -- Description: Rather than sanitize the page, when a XSS attack is detected, the browser will prevent rendering of the page. --
-- --- X-Content-Type-Options is configured. -- Header: X-Content-Type-Options: nosniff -- Description: Will prevent the browser from MIME-sniffing a response away from the declared content-type. --
-- --- Content-Security-Policy is configured. -- Header: Content-Security-Policy: script-src 'self' -- Description: Loading policy for all resources type in case of a resource type dedicated directive is not defined (fallback). --
-- --- X-Permitted-Cross-Domain-Policies are configured. -- Header: X-Permitted-Cross-Domain-Policies: none -- Description: No policy files are allowed anywhere on the target server, including this master policy file. --
-- --- Cache-Control is configured -- Header: Cache-Control: private, no-cache, no-store, must-revalidate --
-- --- Pragma is configured -- Header: Pragma: no-cache --
--- Expired is configured -- Header: Expires: Sat, 01 Jan 2000 00:00:00 GMT -- @@ -153,7 +135,6 @@ action = function(host, port) if response.header['strict-transport-security'] then output_info.Strict_Transport_Security = {} - table.insert(output_info.Strict_Transport_Security, "HSTS is configured.") table.insert(output_info.Strict_Transport_Security, "Header: Strict-Transport-Security: " .. response.header['strict-transport-security']) elseif shortport.ssl(host,port) then output_info.Strict_Transport_Security = {} @@ -162,13 +143,11 @@ action = function(host, port) if response.header['public-key-pins-report-only'] then output_info.Public_Key_Pins_Report_Only = {} - table.insert(output_info.Public_Key_Pins_Report_Only, "HPKP is configured.") table.insert(output_info.Public_Key_Pins_Report_Only, "Header: Public-Key-Pins-Report-Only: " .. response.header['public-key-pins-report-only']) end if response.header['x-frame-options'] then output_info.X_Frame_Options = {} - table.insert(output_info.X_Frame_Options, "X-Frame-Options is configured.") table.insert(output_info.X_Frame_Options, "Header: X-Frame-Options: " .. response.header['x-frame-options']) xframe_header = string.lower(response.header['x-frame-options']) @@ -184,7 +163,6 @@ action = function(host, port) if response.header['x-xss-protection'] then output_info.X_XSS_Protection = {} - table.insert(output_info.X_XSS_Protection, "X-XSS-Protection is configured.") table.insert(output_info.X_XSS_Protection, "Header: X-XSS-Protection: " .. response.header['x-xss-protection']) x_xss_header = string.lower(response.header['x-xss-protection']) @@ -200,7 +178,6 @@ action = function(host, port) if response.header['x-content-type-options'] then output_info.X_Content_Type_Options = {} - table.insert(output_info.X_Content_Type_Options, "X-Content-Type-Options is configured.") table.insert(output_info.X_Content_Type_Options, "Header: X-Content-Type-Options: " .. response.header['x-content-type-options']) x_content_type_header = string.lower(response.header['x-content-type-options']) @@ -212,7 +189,6 @@ action = function(host, port) if response.header['content-security-policy'] then output_info.Content_Security_Policy = {} - table.insert(output_info.Content_Security_Policy, "Content-Security-Policy is configured.") table.insert(output_info.Content_Security_Policy, "Header: Content-Security-Policy: " .. response.header['content-security-policy']) csp_header = string.lower(response.header['content-security-policy']) @@ -290,7 +266,6 @@ action = function(host, port) if response.header['x-permitted-cross-domain-policies'] then output_info.X_Permitted_Cross_Domain_Policies = {} - table.insert(output_info.X_Permitted_Cross_Domain_Policies, "X-Permitted-Cross-Domain-Policies are configured.") table.insert(output_info.X_Permitted_Cross_Domain_Policies, "Header: X-Permitted-Cross-Domain-Policies: " .. response.header['x-permitted-cross-domain-policies']) x_cross_domain_header = string.lower(response.header['x-permitted-cross-domain-policies']) @@ -315,26 +290,22 @@ action = function(host, port) end if response.header['expect-ct'] then - output_info.Expect_Ct = {} - table.insert(output_info.Expect_Ct, "Expect-CT is configured.") - table.insert(output_info.Expect_Ct, "Header: Expect-CT: " .. response.header['expect-ct']) + output_info.Expect_CT = {} + table.insert(output_info.Expect_CT, "Header: Expect-CT: " .. response.header['expect-ct']) end if response.header['cache-control'] then output_info.Cache_Control = {} - table.insert(output_info.Cache_Control, "Cache-Control is configured.") table.insert(output_info.Cache_Control, "Header: Cache-Control: " .. response.header['cache-control']) end if response.header['pragma'] then output_info.Pragma = {} - table.insert(output_info.Pragma, "Pragma is configured.") table.insert(output_info.Pragma, "Header: Pragma: " .. response.header['pragma']) end if response.header['expires'] then output_info.Expires = {} - table.insert(output_info.Expires, "Expires is configured.") table.insert(output_info.Expires, "Header: Expires: " .. response.header['expires']) end