diff --git a/.github/workflows/blank.yml b/.github/workflows/blank.yml new file mode 100644 index 0000000..746e72c --- /dev/null +++ b/.github/workflows/blank.yml @@ -0,0 +1,36 @@ +# This is a basic workflow to help you get started with Actions + +name: CI + +# Controls when the workflow will run +on: + # Triggers the workflow on push or pull request events but only for the "master" branch + push: + branches: [ "master" ] + pull_request: + branches: [ "master" ] + + # Allows you to run this workflow manually from the Actions tab + workflow_dispatch: + +# A workflow run is made up of one or more jobs that can run sequentially or in parallel +jobs: + # This workflow contains a single job called "build" + build: + # The type of runner that the job will run on + runs-on: ubuntu-latest + + # Steps represent a sequence of tasks that will be executed as part of the job + steps: + # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it + - uses: actions/checkout@v4 + + # Runs a single command using the runners shell + - name: Run a one-line script + run: echo Hello, world! + + # Runs a set of commands using the runners shell + - name: Run a multi-line script + run: | + echo Add other actions to build, + echo test, and deploy your project. diff --git a/LICENSE b/LICENSE index 0bba5a2..27f1af3 100644 --- a/LICENSE +++ b/LICENSE @@ -1,6 +1,10 @@ MIT License +<<<<<<< HEAD Copyright (c) 2024 Alla Krishna Vamsi Reddy +======= +Copyright (c) [year] [fullname] +>>>>>>> efd51c6 (Initial commit) Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal diff --git a/README.md b/README.md index 501ea92..abc9f8d 100644 --- a/README.md +++ b/README.md @@ -1,2 +1,153 @@ -# security-headers-tool - A security headers tool is a software application or online service designed to analyze and evaluate the security headers implemented on a website or web application. These tools inspect HTTP response headers sent by a web server to ensure that proper security measures are in place to protect against various types of attacks and vulnerabilities. +###Security Headers Tool + +This repository contains a set of Python scripts designed to check the presence and configuration of security HTTP headers in web server responses. + +Table of Contents +Installation +Scripts Overview +1. check_headers.py +2. check_specific_header.py +3. check_specific_headerr.py +4. enhanced_security_header_checker.py +5. security_headers_checker.py +6. spider.py + +## Scripts + +check_headers.py: Analyzes HTTP response headers for security settings. +check_specific_header.py: Checks for specific security headers in HTTP responses. +check_specific_headerr.py: Checks for specific security headers in HTTP responses using URLs from a file. +enhanced_security_header_checker.py: Performs enhanced security header checks on a given URL. +security_headers_checker.py: Checks for predefined security headers in the response headers of a specified URL. +spider.py: Web crawler to collect URLs for testing + +## Supported Security Headers and Significance + +The tool checks for the following security headers and explains their significance: + +- **Content-Security-Policy (CSP)**: Specifies approved sources for content, protecting against XSS and data injection attacks. +- **X-XSS-Protection**: Enables or disables the browser's XSS protection. +- **Strict-Transport-Security (HSTS)**: Ensures that browsers only access a website over HTTPS, preventing protocol downgrade attacks. +- **X-Frame-Options**: Prevents clickjacking attacks by controlling if and how a page can be loaded within a frame or iframe. +- **X-Content-Type-Options**: Prevents browsers from MIME-sniffing a response away from the declared content type. +- **Referrer-Policy**: Controls how much referrer information is included with requests. + +Each security header contributes to enhancing the security posture of a web application by mitigating specific types of attacks. + +## Usage + +To use the scripts, ensure you have Python installed. Install any required dependencies with: + +### Prerequisites + +- Python 3.x installed on your system. + +### Installation + +1. **Clone the Repository:** + + ```bash + git clone https://github.com/Cipherkrish69x/security-headers-tool.git + cd security-headers-tool + ``` + +2. **Install Requirements:** + + Ensure you have Python 3 installed. Install the required Python packages using pip: + + ```bash + pip install -r requirements.txt + ``` +- - pip install requests + - pip install requests argparse +## Scripts Overview + +### 1. `check_headers.py` + +-- python check_headers.py --urls-file urls.txt --headers-file headers.txt --output-file output.json +This script checks the presence of specified HTTP headers in the response headers of a single URL. + +Benefits of JSON Output: +Data Persistence: JSON output allows for persistent storage and retrieval of results. +Portability: JSON files can be easily shared and transported between different systems. +Flexibility: JSON output can be processed and analyzed using a wide range of tools and libraries. + +Use the --help Option: +Incorporate a built-in help menu (--help option) using argparse + +- python check_headers.py --help + + +**Usage:** + +```bash +python3 check_headers.py --urls-file urls.txt --headers-file headers.txt --output-file results.json +``` + +- `--urls-file`: Path to a text file containing URLs to check. +- `--headers-file`: Path to a text file containing HTTP headers to verify. +- `--output-file`: (Optional) Path to save the JSON results. + +### 2. `check_specific_header.py` + +Checks the presence of a specific HTTP header in the response headers of multiple URLs. + +**Usage:** + +```bash +python3 check_specific_header.py +``` + +- You will be prompted to enter the header name and URLs separated by spaces. + +### 3. `check_specific_headerr.py` + +Similar to `check_specific_header.py`, but reads URLs from a file (`urls.txt`). + +**Usage:** + +```bash +python3 check_specific_headerr.py +``` + +- Reads URLs from the `urls.txt` file and prompts for the header name. + +### 4. `enhanced_security_header_checker.py` + +-- python enhanced_security_header_checker.py https://example.com --output-file result.txt + +Performs enhanced security header checks on a single URL. + +**Usage:** + +```bash +python3 enhanced_security_header_checker.py --output-file output.txt +``` + +- Replace `` with the URL you want to check. +- Use `--output-file` to specify a file to save the results. + +### 5. `security_headers_checker.py` + +Checks for the presence and configuration of a set of predefined security headers in a given URL. + +**Usage:** + +```bash +python3 security_headers_checker.py +``` + +- You will be prompted to enter the URL you want to test. + +## Author + +- **Alla Krishna Vamsi Reddy** ([GitHub Profile](https://github.com/Cipherkrish69x)) +- GitHub: Cipherkrish69x + +#### License + +This project is licensed under the [MIT License](LICENSE). + +--- + + diff --git a/check_headers.py b/check_headers.py new file mode 100755 index 0000000..4a7a8d9 --- /dev/null +++ b/check_headers.py @@ -0,0 +1,54 @@ +#!/usr/bin/env python3 + +import argparse +import requests +import json + +def check_headers(url, headers): + try: + response = requests.get(url) + response_headers = response.headers + results = {header: (header in response_headers) for header in headers} + return results + except requests.exceptions.RequestException as e: + print(f"Error accessing {url}: {e}") + return {} + +def check_multiple_urls(urls_file, headers_file, output_file): + try: + with open(urls_file, 'r') as f: + urls = [line.strip() for line in f.readlines() if line.strip()] + + with open(headers_file, 'r') as f: + headers = [line.strip() for line in f.readlines() if line.strip()] + + results = {} + for url in urls: + results[url] = check_headers(url, headers) + + if output_file: + with open(output_file, 'w') as f: + json.dump(results, f, indent=4) + print(f"Results saved to {output_file}") + + print("\nResults:") + for url, result in results.items(): + print(f"- {url}:") + for header, present in result.items(): + status = "Present" if present else "Missing" + print(f" - {header}: {status}") + + except FileNotFoundError as e: + print(f"Error: {e}") + +def main(): + parser = argparse.ArgumentParser(description="Security Header Checker Tool") + parser.add_argument("--urls-file", required=True, help="Path to the file containing URLs") + parser.add_argument("--headers-file", required=True, help="Path to the file containing headers") + parser.add_argument("--output-file", help="Path to save the output JSON file") + args = parser.parse_args() + + check_multiple_urls(args.urls_file, args.headers_file, args.output_file) + +if __name__ == "__main__": + main() diff --git a/check_specific_header.py b/check_specific_header.py new file mode 100755 index 0000000..76d990a --- /dev/null +++ b/check_specific_header.py @@ -0,0 +1,27 @@ +import requests + +def check_specific_header(urls, header_name): + for url in urls: + try: + response = requests.get(url) + headers = response.headers + + if header_name in headers: + print(f"{url}: {header_name} header is present") + else: + print(f"{url}: {header_name} header is missing") + + except requests.exceptions.RequestException as e: + print(f"Error accessing {url}: {e}") + +# Main function to test the tool +if __name__ == "__main__": + # Accept input from the user + header_name = input("Enter the header name to check (e.g., Referrer-Policy): ") + urls_input = input("Enter URLs separated by spaces: ") + + # Split input URLs into a list + urls = urls_input.split() + + # Call the function to check the specified header for each URL + check_specific_header(urls, header_name) diff --git a/check_specific_headerr.py b/check_specific_headerr.py new file mode 100644 index 0000000..e5b8a2a --- /dev/null +++ b/check_specific_headerr.py @@ -0,0 +1,23 @@ +import requests + +def check_specific_header(urls, header_name): + for url in urls: + try: + response = requests.get(url) + headers = response.headers + + if header_name in headers: + print(f"{url}: {header_name} header is present") + else: + print(f"{url}: {header_name} header is missing") + + except requests.exceptions.RequestException as e: + print(f"Error accessing {url}: {e}") + +# Main function to test the tool +if __name__ == "__main__": + header_name = "Referrer-Policy" # Specify the header to check + with open("urls.txt", "r") as file: + urls = [line.strip() for line in file.readlines() if line.strip()] + + check_specific_header(urls, header_name) diff --git a/enhanced_security_header_checker.py b/enhanced_security_header_checker.py new file mode 100755 index 0000000..c4ed8ee --- /dev/null +++ b/enhanced_security_header_checker.py @@ -0,0 +1,41 @@ +import requests +import argparse + +def check_security_headers(url): + try: + response = requests.get(url) + headers = response.headers + + # Implement logic to check specific security headers + # Example: Check for Referrer-Policy header + if 'Referrer-Policy' in headers: + return "Referrer-Policy header is present." + else: + return "Referrer-Policy header is missing." + + # Implement checks for other security headers... + + except requests.exceptions.RequestException as e: + return f"Error accessing {url}: {e}" + +def main(): + # Parse command-line arguments + parser = argparse.ArgumentParser(description="Enhanced Security Header Checker Tool") + parser.add_argument("url", help="URL to check for security headers") + parser.add_argument("--output-file", help="Path to save the output file") + args = parser.parse_args() + + # Perform security header checks + result = check_security_headers(args.url) + + if args.output_file: + # Write result to output file + with open(args.output_file, "w") as output_file: + output_file.write(result) + print(f"Results saved to: {args.output_file}") + else: + # Print result to console + print(result) + +if __name__ == "__main__": + main() diff --git a/security_headers_checker.py b/security_headers_checker.py new file mode 100755 index 0000000..8054ad6 --- /dev/null +++ b/security_headers_checker.py @@ -0,0 +1,35 @@ +import requests + +def check_security_headers(url): + try: + response = requests.get(url) + headers = response.headers + + required_headers = [ + 'Content-Security-Policy', + 'X-XSS-Protection', + 'Strict-Transport-Security', + 'X-Frame-Options', + 'X-Content-Type-Options', + 'Referrer-Policy' + ] + + missing_headers = [] + for header in required_headers: + if header not in headers: + missing_headers.append(header) + + if missing_headers: + print("Security headers missing or misconfigured:") + for header in missing_headers: + print(f"- {header}") + else: + print("All required security headers are present and correctly configured.") + + except requests.exceptions.RequestException as e: + print(f"Error: {e}") + +# Main function to test the tool +if __name__ == "__main__": + target_url = input("Enter the URL to test: ") + check_security_headers(target_url) diff --git a/spider.py b/spider.py new file mode 100755 index 0000000..7926866 --- /dev/null +++ b/spider.py @@ -0,0 +1,60 @@ +import requests +from bs4 import BeautifulSoup +from urllib.parse import urljoin, urlparse + +class Spider: + def __init__(self): + self.base_url = None + self.visited_urls = set() + self.internal_urls = set() + self.external_urls = set() + + def is_valid_url(self, url): + parsed = urlparse(url) + return bool(parsed.scheme) and bool(parsed.netloc) + + def get_links(self, url): + try: + response = requests.get(url) + soup = BeautifulSoup(response.text, 'html.parser') + links = soup.find_all('a', href=True) + return [link['href'] for link in links] + except Exception as e: + print(f"Error retrieving links from {url}: {e}") + return [] + + def crawl(self, url): + if url in self.visited_urls: + return + self.visited_urls.add(url) + + links = self.get_links(url) + for link in links: + full_url = urljoin(url, link) + if self.is_valid_url(full_url): + if self.base_url in full_url: + self.internal_urls.add(full_url) + self.crawl(full_url) + else: + self.external_urls.add(full_url) + + def start(self): + while True: + self.base_url = input("Enter the base URL to spider (e.g., https://example.com): ") + if self.base_url.strip(): + break + + self.crawl(self.base_url) + print("Spidering complete.") + print(f"Internal URLs found: {len(self.internal_urls)}") + print(f"External URLs found: {len(self.external_urls)}") + + if self.external_urls: + print("\nExternal URLs:") + for url in self.external_urls: + print(url) + +# Usage example: +if __name__ == "__main__": + spider = Spider() + spider.start() diff --git a/urls.txt b/urls.txt new file mode 100644 index 0000000..388ef6e --- /dev/null +++ b/urls.txt @@ -0,0 +1,3 @@ +https://example.com +https://google.com +https://github.com \ No newline at end of file diff --git a/wordlist.txt b/wordlist.txt new file mode 100644 index 0000000..fe3888b --- /dev/null +++ b/wordlist.txt @@ -0,0 +1,23 @@ +index.html +index.htm +index.php +index.asp +default.asp +about.html +about.htm +about.php +contact.html +contact.htm +contact.php +services.html +services.htm +services.php +products.html +products.htm +products.php +login.html +login.htm +login.php +register.html +register.htm +register.php