mirror of
https://github.com/projectdiscovery/nuclei-templates.git
synced 2026-01-31 15:53:33 +08:00
107 lines
3.2 KiB
YAML
107 lines
3.2 KiB
YAML
id: http-missing-security-headers
|
|
|
|
info:
|
|
name: HTTP Missing Security Headers
|
|
author: socketz,geeknik,G4L1T0,convisoappsec,kurohost,dawid-czarnecki,forgedhallpass,jub0bs,userdehghani
|
|
severity: info
|
|
description: |
|
|
This template searches for missing HTTP security headers. The impact of these missing headers can vary.
|
|
metadata:
|
|
max-request: 1
|
|
tags: misconfig,headers,generic,vuln
|
|
|
|
http:
|
|
- method: GET
|
|
path:
|
|
- "{{BaseURL}}"
|
|
|
|
host-redirects: true
|
|
max-redirects: 3
|
|
|
|
matchers-condition: or
|
|
matchers:
|
|
- type: dsl
|
|
name: strict-transport-security
|
|
dsl:
|
|
- "!regex('(?i)strict-transport-security', header)"
|
|
- "status_code != 301 && status_code != 302"
|
|
condition: and
|
|
|
|
- type: dsl
|
|
name: content-security-policy
|
|
dsl:
|
|
- "!regex('(?i)content-security-policy', header)"
|
|
- "status_code != 301 && status_code != 302"
|
|
condition: and
|
|
|
|
- type: dsl
|
|
name: permissions-policy
|
|
dsl:
|
|
- "!regex('(?i)permissions-policy', header)"
|
|
- "status_code != 301 && status_code != 302"
|
|
condition: and
|
|
|
|
- type: dsl
|
|
name: x-frame-options
|
|
dsl:
|
|
- "!regex('(?i)x-frame-options', header)"
|
|
- "status_code != 301 && status_code != 302"
|
|
condition: and
|
|
|
|
- type: dsl
|
|
name: x-content-type-options
|
|
dsl:
|
|
- "!regex('(?i)x-content-type-options', header)"
|
|
- "status_code != 301 && status_code != 302"
|
|
condition: and
|
|
|
|
- type: dsl
|
|
name: x-permitted-cross-domain-policies
|
|
dsl:
|
|
- "!regex('(?i)x-permitted-cross-domain-policies', header)"
|
|
- "status_code != 301 && status_code != 302"
|
|
condition: and
|
|
|
|
- type: dsl
|
|
name: referrer-policy
|
|
dsl:
|
|
- "!regex('(?i)referrer-policy', header)"
|
|
- "status_code != 301 && status_code != 302"
|
|
condition: and
|
|
|
|
- type: dsl
|
|
name: clear-site-data
|
|
dsl:
|
|
- "!regex('(?i)clear-site-data', header)"
|
|
- "status_code != 301 && status_code != 302"
|
|
condition: and
|
|
|
|
- type: dsl
|
|
name: cross-origin-embedder-policy
|
|
dsl:
|
|
- "!regex('(?i)cross-origin-embedder-policy', header)"
|
|
- "status_code != 301 && status_code != 302"
|
|
condition: and
|
|
|
|
- type: dsl
|
|
name: cross-origin-opener-policy
|
|
dsl:
|
|
- "!regex('(?i)cross-origin-opener-policy', header)"
|
|
- "status_code != 301 && status_code != 302"
|
|
condition: and
|
|
|
|
- type: dsl
|
|
name: cross-origin-resource-policy
|
|
dsl:
|
|
- "!regex('(?i)cross-origin-resource-policy', header)"
|
|
- "status_code != 301 && status_code != 302"
|
|
condition: and
|
|
|
|
- type: dsl
|
|
name: content-type-charset-specification
|
|
dsl:
|
|
- "!regex('(?i)content-type', header)"
|
|
- "!regex('(?i)charset', header)"
|
|
- "status_code != 301 && status_code != 302"
|
|
condition: and
|
|
# digest: 4a0a004730450221009501511aaa9b56f04bfd197d04580e858e5320a6acc9c83b53a3d0f0885c72e8022028b7161b9946e275a7c36696f0cc2c8f54f886ff3a97b138aafe166090443e4e:922c64590222798bb761d5b6d8e72950 |