Re: New NSE Script http-security-headers.nse
George Chatzisofroniou <[email protected]>
| Newsgroups | gmane.comp.security.nmap.devel |
|---|---|
| Message-ID | <CACeRBzn=G6MP3nh-oakHsS-L6z1ZTrQMnvdCCStMBx60cRSH7w@mail.gmail.com> |
Hi Vinamra, Do you think you can also add a check for the "Cache-Control", "Pragma" and "Expires" headers? While these are not strictly "security" headers, in web applications that transmit sensitive information it is recommended to disable client-side caching by making use of these headers. More information here: https://stackoverflow.com/questions/49547/how-to-control-web-page-caching-across-all-browsers George On Wed, May 31, 2017 at 2:23 PM, Robin Wood <[email protected]> wrote: > Why not check the new referrer header as well? > > https://scotthelme.co.uk/a-new-security-header-referrer-policy/ > > Robin > > > On Wed, 31 May 2017, 12:19 Vinamra Bhatia, <[email protected]> wrote: >> >> Hello All, >> >> This is regarding a NSE Script my mentor and I were working last week. >> >> The script checks for the HTTP response headers related to security given >> in OWASP Secure Headers Project, shows whether they are configured and gives >> a brief description of them. >> >> The script requests the server for the header with http.head and parses it >> to list headers found with their configurations. It checks for HSTS(HTTP >> Strict Transport Security), HPKP(HTTP Public Key Pins), X-Frame-Options, >> X-XSS-Protection, X-Content-Type-Options, Content-Security-Policy and >> X-Permitted-Cross-Domain-Policies. >> >> There is another script titled http-hsts-verify. The new script already >> includes the checks provided by http-hsts-verify and does much more >> comprehensive testing. Hence when we commit the new script, we should remove >> the other one. >> >> Github PR for the same https://github.com/nmap/nmap/pull/793 >> >> We would love to take suggestions on this. Thanks and have a great day! >> >> With Regards >> Vinamra >> >> >> _______________________________________________ >> Sent through the dev mailing list >> https://nmap.org/mailman/listinfo/dev >> Archived at http://seclists.org/nmap-dev/ > > > _______________________________________________ > Sent through the dev mailing list > https://nmap.org/mailman/listinfo/dev > Archived at http://seclists.org/nmap-dev/ _______________________________________________ Sent through the dev mailing list https://nmap.org/mailman/listinfo/dev Archived at http://seclists.org/nmap-dev/