0xbharath / domains-from-csp

A script to extract domain names from Content Security Policy(CSP) headers

domains-from-csp

A Python script to parse domain names from CSP header

• A script to extract domain names from Content Security Policy(CSP) headers
• The output is print to stdout for now

Demo

Screenshots

3rd party package dependency

requests

click

Setup

• Clone this repo

$ git clone [email protected]:yamakira/censys-enumeration.git

• Install dependencies

$ pipenv install

• Check help menu

$ python csp_parser.py --help
                                                                                                   2 ↵
Usage: csp_parser.py [OPTIONS] URL

Options:
  -r, --resolve / --no-resolve  Enable/Disable DNS resolution
  --help                        Show this message and exit.

Usage

• Parse the CSP header for domain names but don't do DNS resolution

$ python csp_parser.py target_url

• Parse the CSP header for domain names and also do DNS resolution

$ python csp_parser.py target_url --resolve

$ python csp_parser.py target_url -r

domains-from-csp's Issues

TypeError: main() got an unexpected keyword argument 'whois'

python csp_parser.py -u https://hackerone.com -r
Traceback (most recent call last):
File "csp_parser.py", line 129, in
main()
File "/usr/lib/python2.7/dist-packages/click/core.py", line 722, in call
return self.main(*args, **kwargs)
File "/usr/lib/python2.7/dist-packages/click/core.py", line 697, in main
rv = self.invoke(ctx)
File "/usr/lib/python2.7/dist-packages/click/core.py", line 895, in invoke
return ctx.invoke(self.callback, **ctx.params)
File "/usr/lib/python2.7/dist-packages/click/core.py", line 535, in invoke
return callback(*args, **kwargs)
TypeError: main() got an unexpected keyword argument 'whois'

Extract the csp from a 302 response

There are cases when the csp is present in redirect response headers itself .
This script only extracts the csp from response of location header after following the redirect

how come the readme says $ git clone [email protected]:yamakira/censys-enumeration.git ?

KeyError in get_csp_header(url)

Line 64-65 in csp_parser.py:

elif 'content-security-policy-report-only' in r.headers:
csp_header = r.headers["content-security-policy-report-only:"]

There is no key " content-security-policy-report-only: " - need to delete " : " in the end, then everything works fine

error

root@kali:~/tools/Recon/domains-from-csp# python csp_parser.py -u https://go.com --resolve
Traceback (most recent call last):
File "csp_parser.py", line 4, in
import click
ImportError: No module named click