From 2cc892a6451ccf044d4abec4a4428c903245904c Mon Sep 17 00:00:00 2001 From: r--w Date: Wed, 14 Oct 2015 15:45:55 +0200 Subject: [PATCH 1/2] Fixed bug for x-frame-options header --- gethead.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/gethead.py b/gethead.py index f4306cb..b4b14f2 100644 --- a/gethead.py +++ b/gethead.py @@ -60,7 +60,7 @@ def printout(text, colour=WHITE): printout('- Server does not enforce Cross-Site Scripting Protection.\nThe X-XSS-Protection Header setting is either inadequate or missing.\nClient may be vulnerable to Cross-Site Scripting Attacks.\n\n', WHITE) # check x-frame-options: -if response.info().getheader('x-frame-options') == 'deny' or 'sameorigin': +if response.info().getheader('x-frame-options') and response.info().getheader('x-frame-options').lower() in ['deny', 'sameorigin']: printout('(X-Frame-Options) Cross-Frame Scripting Protection is enforced.\n\n', GREEN) else: printout('Vulnerability ', RED) From bd4e7d84c5be3234fa98d779d7dfd9602f7f0278 Mon Sep 17 00:00:00 2001 From: r--w Date: Tue, 29 Dec 2015 11:54:58 +0100 Subject: [PATCH 2/2] Changed X-Content-Security-Policy into Content-Security-Policy --- gethead.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/gethead.py b/gethead.py index b4b14f2..88fdb4c 100644 --- a/gethead.py +++ b/gethead.py @@ -81,8 +81,8 @@ def printout(text, colour=WHITE): printout('- Server does not enforce HTTP over TLS/SSL Connections.\nThe Strict-Transport-Security Header setting is either inadequate or missing.\nClient may be vulnerable to Session Information Leakage.\n\n', WHITE) # check x-content-security-policy: -if response.info().getheader('x-content-security-policy'): - printout('(X-Content-Security-Policy) Content Security Policy is enforced.\n\n', GREEN) +if response.info().getheader('content-security-policy'): + printout('(Content-Security-Policy) Content Security Policy is enforced.\n\n', GREEN) else: printout('Vulnerability ', RED) printout('- Server does not enforce a Content Security Policy.\nThe X-Content-Security-Policy Header setting is either inadequate or missing.\nClient may be vulnerable to Cross-Site Scripting and Injection Attacks.\n\n', WHITE)