santoru / shcheck

A basic tool to check security headers of a website

shcheck - Security Header Check

Check security headers on a target website

I did this tool to help me to check which security headers are enabled on certain websites.

The tool is very simple and it's the result of few minutes of coding.

It just check headers and print a report about which are enabled and which not

I think there is a lot to improve, and I will be grateful if somebody wants to help

How to run:

Pypi

pip3 install shcheck
shcheck.py https://insecurity.blog

Docker

First build your docker container using something like this:

docker build -t shcheck .

Then simply run your docker container using something like this where you specify which website you want to check headers on:

docker run -it --rm shcheck https://insecurity.blog

From source

git clone https://github.com/santoru/shcheck && cd shcheck
./shcheck.py https://insecurity.blog

Standalone script

If you want to run shcheck as a standalone script, just grab the shcheck.py script from the shcheck module/folder and copy it around.

Usage

Usage: ./shcheck.py [options] <target>

Options:
  -h, --help            show this help message and exit
  -p PORT, --port=PORT  Set a custom port to connect to
  -c COOKIE_STRING, --cookie=COOKIE_STRING
                        Set cookies for the request
  -a HEADER_STRING, --add-header=HEADER_STRING
                        Add headers for the request e.g. 'Header: value'
  -d, --disable-ssl-check
                        Disable SSL/TLS certificate validation
  -g, --use-get-method  Use GET method instead HEAD method
  -j, --json-output     Print the output in JSON format
  -i, --information     Display information headers
  -x, --caching         Display caching headers
  -k, --deprecated      Display deprecated headers
  --proxy=PROXY_URL     Set a proxy (Ex: http://127.0.0.1:8080)
  --hfile=PATH_TO_FILE  Load a list of hosts from a flat file
  --colours=COLOURS     Set up a colour profile [dark/light/none]
  --colors=COLOURS      Alias for colours for US English

shcheck's Issues

Option "-no-color" request

Hello,

Your tool is great, and I would like to use it. However, when storing shcheck's output to a file, the colors are not visible but the color codes instead, which makes it very difficult to read. Most other tools I use have a "-no-color" switch which disables any colors, allowing to store raw output to files. That would be great to have such option.

Additionaly, having a label "[warn]", "[info]", or "[crit]" before each http header when disabling colors would be nice, but not required :-)

I hope you will see the benefits of these feature requests !

Regards,
Guillaume

Clean up some deprecation

X-XSS-Protection is pretty much unsupported by any real browser (IIRC Internet Explorer, and maybe Safari) still honour it. And it is best implemented by a content security policy anyway, so can we remove it from the list.

Also X-Permitted-Cross-Domain-Policies, is default secure, if it doesn't exist then Flash/Air will go to a crossdomain.xml. If neither exist then Flash/Air will refuse to work. So it's probably best to be removed from the list too.

typo on line 299

https://github.com/meliot/shcheck/blob/master/shcheck.py#L299

json_headers["information_disclosure"][infoh] = headers.get(ifoh) should probably be json_headers["information_disclosure"][infoh] = headers.get(infoh)

X-Frame-Options is obsoleted by CSP frame-ancestors

Hello,

I see the tools keeps reporting as "warning" the lack of "X-Frame-Options".

This header has been obsoleted by CSP frame-ancestors long time ago and it is currently ignored by most of the browsers. Are we sure we should keep highlighting the lack of this header as a "warning"? I humbly propose you to remove that header check, adding it won't have the desired effect for most modern browsers.

Alternatively, maybe add a condition to highlight the lack of this header if it also lacks the CSP frame-ancestors directive?

Thank you for your tool! Very useful

A quiet option

Can you add a -q, quiet option where the tool checks if headers are present but doesn't show the details?

P.S. Please let me know how I can support this project!

Update the response headers according to OWASP Secure Headers Project

Hi there,

I recommend to update the checked headers according to the following project:
https://owasp.org/www-project-secure-headers/

The following HTTP Response header are deprecated according to this project:

• Expect-CT
• X-XSS-Protection

Best Regards,

Manuel

License?

Hey, this looks pretty useful and I like the output compared to some of the other scripts. What license are you putting this under (MIT?). Thanks

Headers with lowercase letters are not identified

I found a problem with the tool, it seems to be case sensitive. it does not identify when the header is in lowercase letters.

Stops running on a list when a host is unreachable

While using the "--hfile=" parameter and in the case that one host is not reachable, the tool will completely stop and not process the rest of the list. It would be great if it would just run through the whole list.
Maybe add a feature that makes the tool stop when something is unreachable.

Thanks in advance!

X-XSS-Protection is not detected

X-XSS-Protection is not detected by the script

Check for X-Powered-By

I don't know enough about python (yet) to get it working properly. Would it be possible to have it check for an empty value for X-Powered-By?

Dodgy counting

======================================================
 > shcheck.py - santoru ..............................
------------------------------------------------------
 Simple tool to check security headers on a webserver
======================================================

[*] Analyzing headers of https://(redacted)
[*] Effective URL: https://(redacted)
[*] Header X-XSS-Protection is present! (Value: 1; mode=block)
[*] Header X-Frame-Options is present! (Value: DENY)
[*] Header X-Content-Type-Options is present! (Value: nosniff)
[*] Header Strict-Transport-Security is present! (Value: max-age=63072000; includeSubdomains; preload)
[*] Header Content-Security-Policy is present! (Value: default-src 'self'; img-src 'self' *.loc.gov loc.gov data:; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; object-src 'none'; font-src 'self' data:;)
[*] Header Referrer-Policy is present! (Value: same-origin)
[*] Header Expect-CT is present! (Value: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct")
[*] Header Permissions-Policy is present! (Value: : accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), display-capture(), fullscreen=(self), geolocation=(), gyroscope=(), interest-cohort=(), magnetometer=(), microphone=(), midi=(), payment=(), usb=(), vibrate=(), vr=())
[*] Header Cross-Origin-Embedder-Policy is present! (Value: : require-corp)
[*] Header Cross-Origin-Resource-Policy is present! (Value: : same-site)
[*] Header Cross-Origin-Opener-Policy is present! (Value: : same-origin)
-------------------------------------------------------
[!] Headers analyzed for https://(redacted)
[+] There are 11 security headers
[-] There are not 1 security headers

So, which security header is missing? It looks like a 1 off bug, or it is failing to report which additional security header it thinks is missing.

Deprecated Security headers reported

The Publick-Key-Pins header is reported as missing, but accordingly, to https://owasp.org/www-project-secure-headers/, the header is deprecated and should not use at all.