![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgSqeHoIz_WQO15ox74s8jbmIUWviT3YQmwndqXoCuxCVqMl_BmnRcKgvNKEd25L8biRFe_3UdfxCRQAU2nx7CS8WAURalukgedEIaybgwQpJzRwrps7DTjKoSKZ1TFl85aKTNgSWFRRwQ/s640/hsecscan.png) **hsecscan** A security scanner for HTTP response headers. **Requirements** Python 2.x **Usage** $ ./hsecscan.py usage: hsecscan.py [-h] [-P] [-p] [-u URL] [-R] [-U User-Agent] [-d 'POST data'] [-x PROXY] A security scanner for HTTP response headers. optional arguments: -h, --help show this help message and exit -P, --database Print the entire response headers database. -p, --headers Print only the enabled response headers from database. -u URL, --URL URL The URL to be scanned. -R, --redirect Print redirect headers. -U User-Agent, --useragent User-Agent Set the User-Agent request header (default: hsecscan). -d 'POST data', --postdata 'POST data' Set the POST data (between single quotes) otherwise will be a GET (example: '{ "q":"query string", "foo":"bar" }'). -x PROXY, --proxy PROXY Set the proxy server (example: 192.168.1.1:8080). **Example** $ ./hsecscan.py -u https://google.com >> RESPONSE INFO << URL: https://www.google.com.br/?gfe_rd=cr&ei=Qlg_Vu-WHqWX8QeHraH4DQ Code: 200 Headers: Date: Sun, 08 Nov 2015 14:12:18 GMT Expires: -1 Cache-Control: private, max-age=0 Content-Type: text/html; charset=ISO-8859-1 P3P: CP="This is not a P3P policy! See http://www.google.com/support/accounts/bin/answer.py?hl=en&answer=151657 for more info." Server: gws X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Set-Cookie: PREF=ID=1111111111111111:FF=0:TM=1446991938:LM=1446991938:V=1:S=wT722CJeTI8DR-6b; expires=Thu, 31-Dec-2015 16:02:17 GMT; path=/; domain=.google.com.br Set-Cookie: NID=73=IQTBy8sF0rXq3cu2hb3JHIYqEarBeft7Ciio6uPF2gChn2tj34-kRocXzBwPb6-BLABp0grZvHf7LQnRQ9Z_YhGgzt-oFrns3BMSIGoGn4BWBA48UtsFw4OsB5RZ4ODz1rZb9XjCYemyZw7e5ZJ5pWftv5DPul0; expires=Mon, 09-May-2016 14:12:18 GMT; path=/; domain=.google.com.br; HttpOnly Alternate-Protocol: 443:quic,p=1 Alt-Svc: quic="www.google.com:443"; p="1"; ma=600,quic=":443"; p="1"; ma=600 Accept-Ranges: none Vary: Accept-Encoding Connection: close >> RESPONSE HEADERS DETAILS << Header Field Name: X-XSS-Protection Value: 1; mode=block Reference: http://blogs.msdn.com/b/ie/archive/2008/07/02/ie8-security-part-iv-the-xss-filter.aspx Security Description: This header enables the Cross-site scripting (XSS) filter built into most recent web browsers. It's usually enabled by default anyway, so the role of this header is to re-enable the filter for this particular website if it was disabled by the user. This header is supported in IE 8+, and in Chrome (not sure which versions). The anti-XSS filter was added in Chrome 4. Its unknown if that version honored this header. Security Reference: https://www.owasp.org/index.php/List_of_useful_HTTP_headers Recommendations: Use "X-XSS-Protection: 1; mode=block" whenever is possible (ref. http://blogs.msdn.com/b/ieinternals/archive/2011/01/31/controlling-the-internet-explorer-xss-filter-with-the-x-xss-protection-http-header.aspx). CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE URL: https://cwe.mitre.org/data/definitions/79.html Header Field Name: Set-Cookie Value: PREF=ID=1111111111111111:FF=0:TM=1446991938:LM=1446991938:V=1:S=wT722CJeTI8DR-6b; expires=Thu, 31-Dec-2015 16:02:17 GMT; path=/; domain=.google.com.br, NID=73=IQTBy8sF0rXq3cu2hb3JHIYqEarBeft7Ciio6uPF2gChn2tj34-kRocXzBwPb6-BLABp0grZvHf7LQnRQ9Z_YhGgzt-oFrns3BMSIGoGn4BWBA48UtsFw4OsB5RZ4ODz1rZb9XjCYemyZw7e5ZJ5pWftv5DPul0; expires=Mon, 09-May-2016 14:12:18 GMT; path=/; domain=.google.com.br; HttpOnly Reference: https://tools.ietf.org/html/rfc6265 Security Description: Cookies have a number of security pitfalls. In particular, cookies encourage developers to rely on ambient authority for authentication, often becoming vulnerable to attacks such as cross-site request forgery. Also, when storing session identifiers in cookies, developers often create session fixation vulnerabilities. Transport-layer encryption, such as that employed in HTTPS, is insufficient to prevent a network attacker from obtaining or altering a victim's cookies because the cookie protocol itself has various vulnerabilities. In addition, by default, cookies do not provide confidentiality or integrity from network attackers, even when used in conjunction with HTTPS. Security Reference: https://tools.ietf.org/html/rfc6265#section-8 Recommendations: Please at least read these references: https://tools.ietf.org/html/rfc6265#section-8 and https://www.owasp.org/index.php/Session_Management_Cheat_Sheet#Cookies. CWE: CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute CWE URL: https://cwe.mitre.org/data/definitions/614.html Header Field Name: Accept-Ranges Value: none Reference: https://tools.ietf.org/html/rfc7233#section-2.3 Security Description: Unconstrained multiple range requests are susceptible to denial-of-service attacks because the effort required to request many overlapping ranges of the same data is tiny compared to the time, memory, and bandwidth consumed by attempting to serve the requested data in many parts. Security Reference: https://tools.ietf.org/html/rfc7233#section-6 Recommendations: Servers ought to ignore, coalesce, or reject egregious range requests, such as requests for more than two overlapping ranges or for many small ranges in a single set, particularly when the ranges are requested out of order for no apparent reason. CWE: CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion') CWE URL: https://cwe.mitre.org/data/definitions/400.html Header Field Name: Expires Value: -1 Reference: https://tools.ietf.org/html/rfc7234#section-5.3 Security Description: Security Reference: Recommendations: CWE: CWE URL: Header Field Name: Vary Value: Accept-Encoding Reference: https://tools.ietf.org/html/rfc7231#section-7.1.4 Security Description: Security Reference: Recommendations: CWE: CWE URL: Header Field Name: Server Value: gws Reference: https://tools.ietf.org/html/rfc7231#section-7.4.2 Security Description: Overly long and detailed Server field values increase response latency and potentially reveal internal implementation details that might make it (slightly) easier for attackers to find and exploit known security holes. Security Reference: https://tools.ietf.org/html/rfc7231#section-7.4.2 Recommendations: An origin server SHOULD NOT generate a Server field containing needlessly fine-grained detail and SHOULD limit the addition of subproducts by third parties. CWE: CWE-200: Information Exposure CWE URL: https://cwe.mitre.org/data/definitions/200.html Header Field Name: Connection Value: close Reference: https://tools.ietf.org/html/rfc7230#section-6.1 Security Description: Security Reference: Recommendations: CWE: CWE URL: Header Field Name: Cache-Control Value: private, max-age=0 Reference: https://tools.ietf.org/html/rfc7234#section-5.2 Security Description: Caches expose additional potential vulnerabilities, since the contents of the cache represent an attractive target for malicious exploitation. Because cache contents persist after an HTTP request is complete, an attack on the cache can reveal information long after a user believes that the information has been removed from the network. Therefore, cache contents need to be protected as sensitive information. Security Reference: https://tools.ietf.org/html/rfc7234#section-8 Recommendations: Do not store unnecessarily sensitive information in the cache. CWE: CWE-524: Information Exposure Through Caching CWE URL: https://cwe.mitre.org/data/definitions/524.html Header Field Name: Date Value: Sun, 08 Nov 2015 14:12:18 GMT Reference: https://tools.ietf.org/html/rfc7231#section-7.1.1.2 Security Description: Security Reference: Recommendations: CWE: CWE URL: Header Field Name: P3P Value: CP="This is not a P3P policy! See http://www.google.com/support/accounts/bin/answer.py?hl=en&answer=151657 for more info." Reference: http://www.w3.org/TR/P3P11/#syntax_ext Security Description: While P3P itself does not include security mechanisms, it is intended to be used in conjunction with security tools. Users' personal information should always be protected with reasonable security safeguards in keeping with the sensitivity of the information. Security Reference: http://www.w3.org/TR/P3P11/#principles_security Recommendations: - CWE: - CWE URL: - Header Field Name: Content-Type Value: text/html; charset=ISO-8859-1 Reference: https://tools.ietf.org/html/rfc7231#section-3.1.1.5 Security Description: In practice, resource owners do not always properly configure their origin server to provide the correct Content-Type for a given representation, with the result that some clients will examine a payload's content and override the specified type. Clients that do so risk drawing incorrect conclusions, which might expose additional security risks (e.g., "privilege escalation"). Security Reference: https://tools.ietf.org/html/rfc7231#section-3.1.1.5 Recommendations: Properly configure their origin server to provide the correct Content-Type for a given representation. CWE: CWE-430: Deployment of Wrong Handler CWE URL: https://cwe.mitre.org/data/definitions/430.html Header Field Name: X-Frame-Options Value: SAMEORIGIN Reference: https://tools.ietf.org/html/rfc7034 Security Description: The use of "X-Frame-Options" allows a web page from host B to declare that its content (for example, a button, links, text, etc.) must not be displayed in a frame ( or