Dotfiles

Author	SHA1	Message	Date
Jonathan Hodgson	f7d545b57e	Bin: analyse-headers: better csp, x-xss, referer-policy and simple mode The changes amount to the following. x-xss-protection now "passes" if it's set to 1; mode=block The CSP now fails if it doesn't have either a script-src or a default-src. It now checks for referrer-policy simple mode is available which doesn't use colours, and instead prepends each line with either "Misconfigured", "Good", or "Missing. Useful for automating"	1 year ago
Jonathan Hodgson	45a44e55ec	Bin: Analyse-headers: Add windows joke Requested "feature" by Scot, add a joke if used in WSL. Can be hidden with --nojoke in case you need profesionalism	3 years ago
Jonathan Hodgson	cf33344b29	Bin: analyse-headers: no longer warn about no expect-ct	3 years ago
Jonathan Hodgson	16cec4f7e7	BIN: Analyse Headers: improve warning if no lots file	3 years ago
Jonathan Hodgson	ae7bd86993	BIN: analyse-headers: improve csp checking The script now checks included domains against the lots project. https://lots-project.com/ It also checks domains against a list of known jsonp hosts that was found here: `a21f94e348/allowlist_bypasses/jsonp.ts`	3 years ago
Jonathan Hodgson	f5506ada59	Bin: Analyse-headers: makes includesubdomains check case insensitive	3 years ago
Jonathan Hodgson	f01fa8673f	BIN: analyse-headers Adds some more descriptions	4 years ago
Jonathan Hodgson	c92f58859d	BIN: analyse-headers: adds -k flag like curl This flag will prevent curl from doing certificate checks The long form, `--insecure` can also be used Thanks Rob Norman for the suggestion	4 years ago
Jonathan Hodgson	b943a3e03b	Fixes bug where it would try and test an empty line Thanks Rob Norman for reporting and helping debug.	4 years ago
Jonathan Hodgson	c6a0909917	BIN: analyse-headers: Will attempt to decode F5 Cookies Thanks <Huw Edwards> for the idea and help implementing it.	4 years ago
Jonathan Hodgson	12830226e8	adds getnpmversion	4 years ago
Jonathan Hodgson	4d99c42607	The recommended value for x-xss-protection is now 0 The script will now recommend x-xss-protection is set to 0, in line with the recommendation made by owasp. https://owasp.org/www-project-secure-headers/#x-xss-protection	4 years ago
Jonathan Hodgson	865566dd04	Bin: fixes the lucky13 check It apparently works with any cbc cipher and doesn't require tls1	4 years ago
Jonathan Hodgson	30dd026965	BIN: analyse-headers: bug fixes A couple of bug fixes, removed some unnecesary echos and fixed crash if name is too long to fit in the heading box	4 years ago
Jonathan Hodgson	d8e3b894c0	BIN: Adds lucky13 to verifySSL	4 years ago
Jonathan Hodgson	bd7337926e	BIN: Small adjustments to verifySSL The script now prepends the command that is echoed with a $ in order to indicate it is a command that is run Also stops the script showing each cipher that is tested	4 years ago
Jonathan Hodgson	064b53f2bf	BIN: adds sweet32 test to verifySSL	4 years ago
Jonathan Hodgson	dd4b8e5161	BIN: makes the verifySSL print progress messages to stderr I chose to do this because I want to be able to pipe stdout to a file and use it as evidence. I don't need the progress for that	4 years ago
Jonathan Hodgson	995b2a516e	BIN: starts verifySSL script This will evolve to become a script that can be used to verify the findings of a tool like testssl Currently only supports "beast"	4 years ago
Jonathan Hodgson	349963cdad	BIN: fix csp check in analyse-headers the csp function didn't correctly return 1 when a missconfigured csp was found	4 years ago
Jonathan Hodgson	3f01926ab6	Improve handling of CSP Although I'd like to re-do the csp handling, this change fixes the detection of unsafe-inline and unsafe-eval.	4 years ago
Jonathan Hodgson	e77aa36e70	Makes detection of x-frame-options value case insensitive In other words, sameorigin == SAMEORIGIN == saMeOriGIN This is in line with the spec for the header: https://tools.ietf.org/html/rfc7034	4 years ago
Jonathan Hodgson	909a6e5e3c	BIN: analyse-headers: improve expect-ct description	4 years ago
Jonathan Hodgson	b49d000408	BIN: analyse-headers: Checks the access-control-allow-origin header Another suggestion by <Dom Ingram>. For more details on the null issue, read here: https://w3c.github.io/webappsec-cors-for-developers/#avoid-returning-access-control-allow-origin-null	4 years ago
Jonathan Hodgson	f669880037	BIN: analyse-headers: fix most shellcheck warnings The only checks I haven't fixed are the unused variables for colours. I may use them in the future so haven't removed them	4 years ago
Jonathan Hodgson	2e1dff91a3	BIN: analyse-headers: note on x-frame-options if frame-ancestors present If the frame-ancestors content security policy is present, the x-frame-options warning mentions that the content security helps mitigate against clickjacking although for greater browser support, x-frame-options should also be used Thanks <Dom Ingram> for the suggestion	4 years ago
Jonathan Hodgson	1fabc27b79	BIN: analyse-headers: Adds generic version disclosure function if the header contains the word "version" (case insensitively) it will flag it as potential information disclosure Thanks <Dom Ingram> for the suggestion	4 years ago
Jonathan Hodgson	27b9af6327	BIN: analyse-headers: read from stdin if first arg is - This makes testing much easier	4 years ago
Jonathan Hodgson	039f4e2270	BIN: analyse-headers: Add more notes to expect-ct description As pointed out by <Dom Ingram>, the expect-ct is likely to become obsolete in June 2012 https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Expect-CT	4 years ago
Jonathan Hodgson	bf132e16c2	BIN: analyse-headers: Fix incorrect reporting of SSL issues It turns out the SSL flags secure and httponly are not case sensitive. https://tools.ietf.org/html/rfc6265#section-5.2.5 I cannot find any documentation about the SameSite=Strict so I will leave it case sensitive for now. The spec for that section is here: https://tools.ietf.org/html/draft-ietf-httpbis-rfc6265bis-05#section-5.2 Thanks <Dom Ingram> for flagging this	4 years ago
Jonathan Hodgson	69c7355225	BIN: analyse-headers: add expect-ct and start referrer-policy	4 years ago
Jonathan Hodgson	5369861bc8	BIN: Analyse-headers: Adds to description for cookie flag	4 years ago
Jonathan Hodgson	3665bb63a2	BIN: analyse-headers: fix error "wrap command not found"	4 years ago
Jonathan Hodgson	97df97a48b	BIN: analyse-headers: adds feature-policy and permissions-policy checks	4 years ago
Jonathan Hodgson	afa3f3495a	BIN: analyse-headers: Wrap text in descriptions The text in descriptions is now wrapped to 80 chars. This does not affect the headers printed at the top which are not wrapped	4 years ago
Jonathan Hodgson	fb5d25dc6c	BIN: Adds SameSite check in analyse-headers script The script will now warn you if the SameSite option is not set to Strict on cookies.	4 years ago
Jonathan Hodgson	c384064641	BIN: Fix webtest script when : in cookies If there was a colon in a cookie, the script would misidentify insecure cookie configurations	4 years ago
Jonathan Hodgson	ab2c56d9b5	BIN: Adds analyse-headers script The script is in early stages of development but should work for some of the most common mis-configurtaions.	4 years ago
Jonathan Hodgson	085f17ab1f	Adds scripts to help with ssl testing	4 years ago
Jonathan Hodgson	77955b1e18	Renames jwtcat to catjwt to avoid clash with 3rd party tool	4 years ago
Jonathan Hodgson	d106799a8b	Creates script for printing jwt web tokens	4 years ago
Jonathan Hodgson	b19db697e8	A start to webtest script	4 years ago
Jonathan Hodgson	b4bdba9e24	Adds getpaths script	4 years ago
Jonathan Hodgson	4ac6ff54dc	changed profile name to headless	5 years ago
Jonathan Hodgson	031ae34a60	Will create firefox profile	5 years ago
Jonathan Hodgson	045a120083	Adds help and checks url is given	5 years ago
Jonathan Hodgson	f0404cd7fc	Makes clickjacking script look for ff dev edition	5 years ago
Jonathan Hodgson	e973957094	Adds script to make clickjacking screenshot	5 years ago
Jonathan Hodgson	55a7d2da4f	Lots of bin changes	5 years ago
Jonathan Hodgson	187872ab6a	Adds a script for turning an html form into a curl requst	5 years ago

50 Commits (f7d545b57e55c0531ec3f5a90432edf4414d779c)