tinfoil 0.0.1

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA1:
+  metadata.gz: 24543aafbae5bc2c8abcfb5a457307e8b6f54f57
+  data.tar.gz: 9c41fc211de0394bbd07f9c7977a1b50a4f8da0c
+SHA512:
+  metadata.gz: 3855221e020ef16674c58a86d67449abb75dbe76f0e020a6a2480213e14f5075688f425c76d4c6bfbe2ba529667965a4985d59783cdb112ec43f0094fbe43c20
+  data.tar.gz: 6e2f09c95ddd5795293029e3466117a53d406d6e62036910359859d178d9fe27ea34b4f844b13f95875a8631f4c2d208c0b33155882d0da8bab3fa336eaf9811

data/.gitignore

@@ -0,0 +1,17 @@
+*.gem
+*.rbc
+.bundle
+.config
+.yardoc
+Gemfile.lock
+InstalledFiles
+_yardoc
+coverage
+doc/
+lib/bundler/man
+pkg
+rdoc
+spec/reports
+test/tmp
+test/version_tmp
+tmp

data/Gemfile

@@ -0,0 +1,4 @@
+source 'https://rubygems.org'
+
+# Specify your gem's dependencies in tinfoil.gemspec
+gemspec

data/LICENSE.txt

@@ -0,0 +1,22 @@
+Copyright (c) 2014 Scott Brown
+
+MIT License
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

data/README.md

@@ -0,0 +1,82 @@
+# Tinfoil
+
+Tinfoil is a command-line utility that scans a Web server externally to listen for its usage of HTTP secure headers.  This utility will scan for the following secure headers:
+
+* [Strict-Transport-Security](http://tools.ietf.org/html/rfc6797)
+* [X-XSS-Protection](http://blogs.msdn.com/b/ie/archive/2008/07/02/ie8-security-part-iv-the-xss-filter.aspx)
+* [X-Content-Type-Options](http://blogs.msdn.com/b/ie/archive/2008/09/02/ie8-security-part-vi-beta-2-update.aspx)
+* [X-Frame-Options](http://tools.ietf.org/html/draft-ietf-websec-x-frame-options-01)
+* [Content-Security-Policy](http://www.w3.org/TR/CSP/)
+
+Not all of these headers are required at all times, so you should use your best judgement when you see something is missing on your Web server.  Best of all, you can selectively ignore the headers that you do not yet support.
+
+## Installation
+
+Install it through RubyGems:
+
+    $ gem install tinfoil
+
+## Usage
+
+Scan a single server
+
+    $ tinfoil www.example.com
+
+Specifying the protocol, ``http://`` or ``https://``, is not required.
+
+You can selectively ignore the secure headers or protocols that you do not want.  For example, to ignore anything related to SSL or the Content-Security-Policy header:
+
+    $ tinfoil --ignore-https --ignore-csp --ignore-sts www.example.com
+
+To view the other options available, you can use the ``--help`` argument.
+
+## Example
+
+The following examples test the secure header support for the main [Github.com](http://github.com) website.
+
+This checks both SSL and non-SSL versions of github.com.  The tool shows that nothing is present on the non-SSL version (because it redirects) and then shows which headers are present on the SSL version.
+
+    greenhole:tinfoil scott$ bin/tinfoil github.com
+    protocol: http
+    protocol: https
+    headers:
+            Strict-Transport-Security: exists
+            X-XSS-Protection: exists
+            X-Content-Type-Options: exists
+            X-Frame-Options: exists
+            Content-Security-Policy: exists
+
+Since we only care about the SSL version of github.com, we tell tinfoil to ignore the non-SSL version.
+
+    greenhole:tinfoil scott$ bin/tinfoil --ignore-http github.com
+    protocol: https
+    headers:
+            Strict-Transport-Security: exists
+            X-XSS-Protection: exists
+            X-Content-Type-Options: exists
+            X-Frame-Options: exists
+            Content-Security-Policy: exists
+
+And, for kicks, we now tell tinfoil to ignore the Content-Security-Policy header for no good reason.
+
+    greenhole:tinfoil scott$ bin/tinfoil --ignore-http --ignore-csp github.com
+    protocol: https
+    headers:
+            Strict-Transport-Security: exists
+            X-XSS-Protection: exists
+            X-Content-Type-Options: exists
+            X-Frame-Options: exists
+            Content-Security-Policy: ignored
+
+## Contributing
+
+1. Fork it
+2. Create your feature branch (`git checkout -b my-new-feature`)
+3. Commit your changes (`git commit -am 'Add some feature'`)
+4. Push to the branch (`git push origin my-new-feature`)
+5. Create new Pull Request
+
+## License
+
+See [LICENSE.txt](LICENSE.txt) for more information.
+

data/Rakefile

@@ -0,0 +1,11 @@
+require "bundler/gem_tasks"
+require 'rake/testtask'
+
+Rake::TestTask.new do |t|
+  t.libs << "test"
+  t.test_files = FileList['test/**/*_test.rb']
+  t.verbose = false
+end
+
+task :default => :test
+

data/bin/tinfoil

@@ -0,0 +1,19 @@
+#!/usr/bin/env ruby
+
+lib = File.expand_path('../../lib', __FILE__)
+$LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
+GEM_NAME = 'tinfoil'
+
+begin
+  require GEM_NAME
+rescue LoadError
+  require 'rubygems'
+  require GEM_NAME
+end
+
+begin
+  Tinfoil::CLI.run(ARGV)
+rescue Tinfoil::AbnormalProgramExitError
+  exit 1
+end
+

data/lib/tinfoil.rb

@@ -0,0 +1,8 @@
+require_relative "tinfoil/version"
+require_relative 'tinfoil/cli'
+require_relative 'tinfoil/errors'
+require_relative 'tinfoil/scanner'
+require_relative 'tinfoil/secure_header'
+
+module Tinfoil
+end

data/lib/tinfoil/cli.rb

@@ -0,0 +1,124 @@
+require 'optparse'
+require 'ostruct'
+
+module Tinfoil
+  class CLI
+    DEFAULT_OUTPUT_FILE = 'results.txt'
+
+    def self.run (args, stdout=$stdout, stderr=$stderr)
+      @@options = default_options
+      parse(args, @@options)
+
+      if @@server.nil?
+        $stderr.puts banner
+        raise AbnormalProgramExitError
+      end
+
+      scanner = Tinfoil::Scanner.new
+      result = scanner.scan(@@server, @@options)
+
+      result.each_pair do |protocol, headers|
+        $stdout.puts "protocol: #{protocol}"
+
+        $stdout.puts "headers:"
+        headers.each do |header|
+          $stdout.puts "\t#{header}"
+        end
+      end
+    end
+
+    class << self
+      private
+
+      def parse (args, options)
+        optparse = OptionParser.new do |opts|
+          opts.on('-h', '--help', 'Display this screen') do
+            $stdout.puts summary
+            $stdout.puts opts
+            raise AbnormalProgramExitError
+          end
+
+          opts.on('--ignore-http', 'Ignores the http protocol') do
+            verbose("Ignoring HTTP")
+            options.ignore_protocols << 'http'
+          end
+
+          opts.on('--ignore-https', 'Ignores the https protocol') do
+            verbose("Ignoring HTTPS")
+            options.ignore_protocols << 'https'
+          end
+
+          opts.on('--ignore-sts', 'Ignores the existence check for the Strict-Transport-Security header') do
+            verbose("Ignoring Strict-Transport-Security header")
+            options.ignore_headers << 'Strict-Transport-Security'
+          end
+
+          opts.on('--ignore-fo', 'Ignores the existence check for the X-Frame-Options header') do
+            verbose("Ignoring X-Frame-Options header")
+            options.ignore_headers << 'X-Frame-Options'
+          end
+
+          opts.on('--ignore-csp', 'Ignores the existence check for the Content-Security-Policy header') do
+            verbose("Ignoring Content-Security-Policy header")
+            options.ignore_headers << 'Content-Security-Policy'
+          end
+
+          opts.on('--ignore-xss', 'Ignores the existence check for the X-XSS-Protection header') do
+            verbose("Ignoring X-XSS-Protection header")
+            options.ignore_headers << 'X-XSS-Protection'
+          end
+
+          opts.on('--ignore-cto', 'Ignores the existence check for the X-Content-Type-Options header') do
+            verbose("Ignoring X-Content-Type-Options header")
+            options.ignore_headers << 'X-Content-Type-Options'
+          end
+
+          opts.on('-t', '--timeout [SECONDS]', Integer, "Change the timeout value.  Default: #{options.timeout} seconds.") do |timeout|
+            verbose("Timeout set to #{timeout} seconds")
+            options.timeout = timeout
+          end
+
+          opts.on_tail('-v', '--verbose', 'Enable verbose output') do
+            options.verbose = true
+          end
+
+          opts.on_tail('--version', 'Display the version') do
+            $stdout.puts Tinfoil::VERSION
+          end
+
+          opts.banner = banner
+        end
+
+        optparse.parse!(args)
+
+        @@server = args.first
+      end
+
+      def default_options
+        options = OpenStruct.new
+        options.verbose = false
+        options.timeout = 10 #seconds
+        options.ignore_headers = []
+        options.ignore_protocols = []
+
+        return options
+      end
+
+      def verbose (msg)
+        $stdout.puts "[CLI] #{msg}" if @@options.verbose
+      end
+
+      def banner
+        "Usage: tinfoil [options] DOMAIN"
+      end
+
+      def summary 
+        string = "tinfoil #{Tinfoil::VERSION} (c) 2014 Scott Brown\n\n"
+        string << "Scans one or more Web servers for the presence of secure headers.  This helps in discovering servers vulnerable to Web-based attack vectors.\n\n"
+
+        return string
+      end
+    end
+  end
+end
+

data/lib/tinfoil/errors.rb

@@ -0,0 +1,7 @@
+module Tinfoil
+  class AbnormalProgramExitError < StandardError; end
+  class NoSuchFileError < StandardError; end
+  class FileAccessError < StandardError; end
+  class TinfoilError < StandardError; end
+end
+

data/lib/tinfoil/scanner.rb

@@ -0,0 +1,97 @@
+require 'ostruct'
+require 'net/http'
+require 'timeout'
+
+module Tinfoil
+  class Scanner
+    def scan (domain, options = OpenStruct.new)
+      @options = options
+      server_result = {}
+
+      [:http, :https].each do |protocol|
+        unless options.ignore_protocols.include?(protocol.to_s)
+          server_result[protocol] = call_server("#{protocol}://" + domain) || []
+        end
+      end
+
+      return server_result
+    end
+
+    private
+
+    def call_server (url)
+      headers = []
+      verbose("Connecting to #{url}")
+      response = nil
+      begin
+        Timeout::timeout (@options.timeout) do
+          response = Net::HTTP.get_response(URI(url))
+        end
+      rescue OpenSSL::SSL::SSLError
+        verbose("SSL error found.  Skipping.")
+      rescue Timeout::Error
+        return []
+      end
+
+      case response
+      when Net::HTTPSuccess
+        verbose("Status 200 OK.  Processing response headers...")
+
+        [ SecureHeader::Type::STS, SecureHeader::Type::XSS, SecureHeader::Type::CTO, SecureHeader::Type::FO, SecureHeader::Type::CSP ].each do |type|
+          header = SecureHeader.new(type)
+          if @options.ignore_headers.include?(type)
+            verbose("#{type} header ignored.")
+            header.ignore = true
+          else
+            if response[type]
+              verbose("#{type} header found.")
+              header.exists = true
+            end
+          end
+          headers << header
+        end
+      when Net::HTTPRedirection
+        verbose("HTTP redirection found.  Skipping.")
+      else
+        verbose("Unknown error occurred.")
+      end
+
+      return headers
+    end
+
+    def process_file
+      raise NoSuchFileError if File.exists?(@options.file)
+      raise InvalidFileAccessError if File.readable?(@options.file)
+    end
+
+    def process_server
+      response = Net::HTTP.get_response(URI(@options.server))
+
+      case response
+      when Net::HTTPSuccess
+        if response['x-frame-options']
+          x_frame_options = true
+        end
+        if response['x-content-type-options']
+          x_content_type_options = true
+        end
+        if response['x-xss-protection']
+          x_xss_protection = true
+        end
+        if response['strict-transport-security']
+          strict_transport_security = true
+        end
+        if response['content-security-policy']
+          content_security_policy = true
+        end
+      when Net::HTTPRedirection
+      else
+      end
+    end
+
+    def verbose (msg)
+      puts "[SCANNER] #{msg}" if @options.verbose
+    end
+  end
+end
+

data/lib/tinfoil/secure_header.rb

@@ -0,0 +1,36 @@
+module Tinfoil
+  class SecureHeader
+    class Type
+      STS = 'Strict-Transport-Security'
+      CSP = 'Content-Security-Policy'
+      XSS = 'X-XSS-Protection'
+      FO = 'X-Frame-Options'
+      CTO = 'X-Content-Type-Options'
+    end
+
+    attr_accessor :name, :ignore, :exists
+
+    def initialize (name)
+      @name = name
+      @ignore = false
+      @exists = false
+    end
+
+    def status
+      if @ignore
+        "ignored"
+      else
+        if @exists
+          "exists"
+        else
+          "missing"
+        end
+      end
+    end
+
+    def to_s
+      "#{@name}: #{status}"
+    end
+  end
+end
+

data/lib/tinfoil/version.rb

@@ -0,0 +1,3 @@
+module Tinfoil
+  VERSION = "0.0.1"
+end

data/test/tinfoil/cli_test.rb

@@ -0,0 +1,56 @@
+require 'test/unit'
+require 'mocha/test_unit'
+require_relative '../../lib/tinfoil'
+
+module Tinfoil
+  class CLITest < Test::Unit::TestCase
+    def test_run_with_no_args_should_cause_program_exit
+      assert_raises Tinfoil::AbnormalProgramExitError do
+        capture_stderr do
+          Tinfoil::CLI.run([])
+        end
+      end
+    end
+
+    def test_run_with_help_arg_causes_program_exit
+      assert_raises Tinfoil::AbnormalProgramExitError do
+        capture_stdout do
+          Tinfoil::CLI.run(['-h'])
+        end
+      end
+    end
+
+    def test_run_with_domain_arg
+      assert_nothing_raised do
+        capture_stdout do
+          Tinfoil::CLI.run(['example.com'])
+        end
+      end
+    end
+
+    private
+
+    def capture_stdout(&block)
+      original_stdout = $stdout
+      $stdout = fake = StringIO.new
+      begin
+        yield
+      ensure
+        $stdout = original_stdout
+      end
+     fake.string
+    end
+
+    def capture_stderr(&block)
+      original_stderr = $stderr
+      $stderr = fake = StringIO.new
+      begin
+        yield
+      ensure
+        $stderr = original_stderr
+      end
+     fake.string
+    end
+  end
+end
+

data/test/tinfoil/scanner_test.rb

@@ -0,0 +1,108 @@
+require 'test/unit'
+require 'mocha/test_unit'
+require 'ostruct'
+require_relative '../../lib/tinfoil'
+
+module Tinfoil
+  class ScannerTest < Test::Unit::TestCase
+    def setup
+      @scanner = Tinfoil::Scanner.new
+
+      @options = OpenStruct.new
+      @options.verbose = false
+      @options.timeout = 10
+      @options.ignore_headers = []
+      @options.ignore_protocols = []
+    end
+
+    def teardown
+      @scanner = nil
+    end
+
+    def test_scan_returns_correct_result_for_one_server
+      mock_remote_call do |result|
+        assert_equal 2, result.size
+        assert result.has_key?(:http)
+        assert result.has_key?(:https)
+      end
+    end
+
+    def test_scan_ignores_http_when_ordered
+      @options.ignore_protocols << "http"
+      mock_remote_call do |result|
+        assert_equal 1, result.size
+        assert !result.has_key?(:http)
+        assert result.has_key?(:https)
+      end
+    end
+
+    def test_scan_ignores_https_when_ordered
+      @options.ignore_protocols << 'https'
+      mock_remote_call do |result|
+        assert_equal 1, result.size
+        assert result.has_key?(:http), 'http should be present'
+        assert !result.has_key?(:https), 'https should not be present'
+      end
+    end
+
+    def test_scan_returns_empty_array_after_timeout
+      Net::HTTP.stubs(:get_response).raises(Timeout::Error)
+      domain = 'example.com'
+      result = @scanner.scan(domain, @options)
+
+      assert_equal 0, result[:http].size
+    end
+
+    def test_scan_ignores_header_when_ordered
+      [ SecureHeader::Type::STS, SecureHeader::Type::XSS, SecureHeader::Type::CTO, SecureHeader::Type::FO, SecureHeader::Type::CSP ].each do |header_name|
+        @options.ignore_headers << header_name
+        mock_remote_call do |result|
+          assert_not_nil result[:http].select { |h| h.name == header_name && h.ignore }.first
+        end
+      end
+    end
+
+    def test_scan_show_header_exists
+      res = custom_response(Tinfoil::SecureHeader::Type::FO)
+      mock_remote_call(res) do |result|
+        assert_not_nil result[:http].select { |h| h.name == Tinfoil::SecureHeader::Type::FO && h.exists }.first
+      end
+    end
+
+    def test_scan_show_missing_header
+      res = custom_response()
+      mock_remote_call(res) do |result|
+        assert_not_nil result[:http].select { |h| h.name == Tinfoil::SecureHeader::Type::CSP && !h.exists }.first
+      end
+    end
+
+    private
+
+    def default_response
+      res = Net::HTTPSuccess.new('1.1',200,'OK')
+      res.add_field Tinfoil::SecureHeader::Type::FO, 'foo'
+      res.add_field Tinfoil::SecureHeader::Type::CSP, 'foo'
+      res.add_field Tinfoil::SecureHeader::Type::XSS, 'foo'
+      res.add_field Tinfoil::SecureHeader::Type::STS, 'foo'
+      res.add_field Tinfoil::SecureHeader::Type::CTO, 'foo'
+      return res
+    end
+
+    def custom_response (*headers)
+      res = Net::HTTPSuccess.new('1.1',200,'OK')
+      headers.each do |h|
+        res.add_field h, 'foo'
+      end
+      return res
+    end
+
+    def mock_remote_call (res = nil, &block)
+      res = default_response if res.nil?
+      Net::HTTP.expects(:get_response).at_least_once.returns(res)
+      domain = 'example.com'
+      result = @scanner.scan(domain, @options)
+      yield result
+    end
+  end
+end
+

data/test/tinfoil/secure_header_test.rb

@@ -0,0 +1,36 @@
+require 'test/unit'
+require_relative '../../lib/tinfoil/secure_header'
+
+module Tinfoil
+  class SecureHeaderTest < Test::Unit::TestCase
+    def setup
+      @header_name = 'SomeHeader'
+      @header = SecureHeader.new(@header_name)
+    end
+
+    def teardown
+      @header = nil
+    end
+
+    def test_status_returns_ignored
+      @header.ignore = true
+      assert_equal "ignored", @header.status
+    end
+
+    def test_status_returns_exists
+      @header.exists = true
+      assert_equal "exists", @header.status
+    end
+
+    def test_status_returns_missing
+      @header.exists = false
+      assert_equal "missing", @header.status
+    end
+
+    def test_to_string_returns_correctly
+      @header.exists = true
+      assert_equal "SomeHeader: exists", @header.to_s
+    end
+  end
+end
+

data/test/tinfoil/version_test.rb

@@ -0,0 +1,11 @@
+require 'test/unit'
+require_relative '../../lib/tinfoil/version'
+
+module Tinfoil
+  class VersionTest < Test::Unit::TestCase
+    def test_contains_version
+      assert Tinfoil::VERSION
+    end
+  end
+end
+

data/tinfoil.gemspec

@@ -0,0 +1,25 @@
+# coding: utf-8
+lib = File.expand_path('../lib', __FILE__)
+$LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
+require 'tinfoil/version'
+
+Gem::Specification.new do |spec|
+  spec.name          = "tinfoil"
+  spec.version       = Tinfoil::VERSION
+  spec.authors       = ["Scott Brown"]
+  spec.email         = ["scott@justplainsimple.com"]
+  spec.description   = %q{A gem to scan a Web server and report whether it contains any or all secure headers}
+  spec.summary       = spec.description
+  spec.homepage      = ""
+  spec.license       = "MIT"
+
+  spec.bindir        = 'bin'
+  spec.files         = `git ls-files`.split($/)
+  spec.executables   = spec.files.grep(%r{^bin/}) { |f| File.basename(f) }
+  spec.test_files    = spec.files.grep(%r{^(test|spec|features)/})
+  spec.require_paths = ["lib"]
+
+  spec.add_development_dependency "bundler", "~> 1.3"
+  spec.add_development_dependency "rake"
+  spec.add_development_dependency "mocha"
+end

metadata

@@ -0,0 +1,114 @@
+--- !ruby/object:Gem::Specification
+name: tinfoil
+version: !ruby/object:Gem::Version
+  version: 0.0.1
+platform: ruby
+authors:
+- Scott Brown
+autorequire: 
+bindir: bin
+cert_chain: []
+date: 2014-03-14 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: bundler
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.3'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.3'
+- !ruby/object:Gem::Dependency
+  name: rake
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: mocha
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+description: A gem to scan a Web server and report whether it contains any or all
+  secure headers
+email:
+- scott@justplainsimple.com
+executables:
+- tinfoil
+extensions: []
+extra_rdoc_files: []
+files:
+- ".gitignore"
+- Gemfile
+- LICENSE.txt
+- README.md
+- Rakefile
+- bin/tinfoil
+- lib/tinfoil.rb
+- lib/tinfoil/cli.rb
+- lib/tinfoil/errors.rb
+- lib/tinfoil/scanner.rb
+- lib/tinfoil/secure_header.rb
+- lib/tinfoil/version.rb
+- test/.gitkeep
+- test/tinfoil/.gitkeep
+- test/tinfoil/cli_test.rb
+- test/tinfoil/scanner_test.rb
+- test/tinfoil/secure_header_test.rb
+- test/tinfoil/version_test.rb
+- tinfoil.gemspec
+homepage: ''
+licenses:
+- MIT
+metadata: {}
+post_install_message: 
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubyforge_project: 
+rubygems_version: 2.2.0
+signing_key: 
+specification_version: 4
+summary: A gem to scan a Web server and report whether it contains any or all secure
+  headers
+test_files:
+- test/.gitkeep
+- test/tinfoil/.gitkeep
+- test/tinfoil/cli_test.rb
+- test/tinfoil/scanner_test.rb
+- test/tinfoil/secure_header_test.rb
+- test/tinfoil/version_test.rb