There are a number of HTTP headers which enhance the security of a website when used. Often ignored, or unknown, these HTTP security headers help prevent common web application vulnerabilities when used.
DrHEADer helps with the audit of security headers received in response to a single request or a list of requests.
When combined with the OWASP Application Security Verification Standard (ASVS) 4.0, it is a useful tool to include as part of an automated CI/CD pipeline which checks for missing HTTP headers.
This project was developed with Python 3.7.4. Whilst it works with Python 2.x, End of Life (EOL) is coming so if possible, use 3.x. The easiest way to install drHEADer is to clone this repository and via a terminal window, run the following command:
$ python3 setup.py install --user
This will install all the pre-requisites and you'll end up with a drheader executable.
There are two ways you could use drHEADer, depending on what you want to achieve. The easiest way is using the CLI.
drHEADer can perform a single scan against a target and report back which headers are present, like so:
$ drheader scan single https://santander.co.uk
If you wish to scan multiple sites, you'll need the targets in a JSON format, or a txt file, like so:
[
{
"url": "https://example.com",
"params": {
"example_parameter_key": "example_parameter_value"
}
},
...
]
For txt files, use the following command:
$ drheader scan bulk -ff targets.txt
There are a number of parameters you can specify during bulk scans, these are:
Option | Description |
---|---|
-p, --post | Use a post request to obtain headers |
--json | Output report as json |
--debug | Show error messages |
--rules FILENAME | Use custom rule set |
--rules-uri URL | Use custom rule set, to download from a remote server |
--merge | Merge custom rule set on top of default set |
--help | Show this message and exit |
--junit | Creates a junit report in ./reports/junit.xml folder |
To save scan results, you can use the --json parameter and pipe it to jq, which is a lightweight and flexible command-line JSON processor,like so:
$ drheader scan single https://santander.co.uk --json | jq '.'
It is also possible to call drHEADer from within an existing project, and this is achieved like so:
from drheader import Drheader
# create drheader instance
drheader_instance = Drheader(headers={'X-XSS-Protection': '1; mode=block'}, status_code=200)
report = drheader_instance.analyze()
print(report)
By default, the tool uses GET method when making a request, but you can change that by supplying the method
argument like this:
# create drheader instance
drheader_instance = Drheader(url="http://test.com", method="POST")
Remember you can use any method supported by requests
such as POST, PUT, GET and DELETE.
At the same time, you can customize the headers sent by the request. For that, you just have to use the request_headers
argument:
# create drheader instance
custom_headers = {"token": "1234aerhga"}
drheader_instance = Drheader(url="http://test.com", request_headers=custom_headers)
As we continue development on drHEADer, we will further enhance this functionality.
The verify argument supported by requests
can be included. The default value is set to True
.
# create drheader instance
drheader_instance = Drheader(url="http://test.com", verify=False)
Other arguments may be included in the future such as timeout, allow_redirects or proxies.
DrHEADer relies on a yaml file that defines the policy it will use when auditing security headers. The file is located at ./drheader/rules.yml
, and you can customise it to fit your particular needs. Please follow this link if you want to know more.
- On ubuntu systems you may need to install libyaml-dev to avoid errors related to a missing yaml.h.
We have a lot of ideas for drHEADer, and will push often as a result. Some of the things you'll see shortly are:
- Building on the Python library to make it easier to embed in your own projects.
- Releasing the API, which is seperate from the core library - the API allows you to hit URLs or endpoints at scale
- Better integration into MiTM proxies.
DrHEADer was developed by the Santander UK Security Engineering team, who are:
- David Albone
- Javier DomÃnguez Ruiz
- Fernando Cabrerizo
- James Morris