yawast 0.6.0.beta4 → 0.6.0.beta5

data/lib/scanner/plugins/dns/generic.rb

@@ -105,48 +105,11 @@ module Yawast
                 end
 
                 if options.srv
-                  File.open(File.dirname(__FILE__) + '/../../../resources/srv_list.txt', 'r') do |f|
-                    f.each_line do |line|
-                      host = line.strip + '.' + root_domain
-                      begin
-                        srv = resv.getresources(host, Resolv::DNS::Resource::IN::SRV)
-
-                        unless srv.empty?
-                          srv.each do |rec|
-                            ip = resv.getaddress rec.target
-
-                            Yawast::Utilities.puts_info "\t\tSRV: #{host}: #{rec.target}:#{rec.port} - #{ip} (#{get_network_info(ip.to_s)})"
-                          end
-                        end
-                      rescue
-                        #if this fails, don't really care
-                      end
-                    end
-                  end
+                  find_srv root_domain, resv
                 end
 
                 if options.subdomains
-                  File.open(File.dirname(__FILE__) + '/../../../resources/subdomain_list.txt', 'r') do |f|
-                    f.each_line do |line|
-                      host = line.strip + '.' + root_domain
-
-                      begin
-                        a = resv.getresources(host, Resolv::DNS::Resource::IN::A)
-
-                        unless a.empty?
-                          a.each do |ip|
-                            if IPAddr.new(ip.address.to_s, Socket::AF_INET).private?
-                              Yawast::Utilities.puts_info "\t\tA: #{host}: #{ip.address}"
-                            else
-                              Yawast::Utilities.puts_info "\t\tA: #{host}: #{ip.address} (#{get_network_info(ip.address)})"
-                            end
-                          end
-                        end
-                      rescue
-                        #if this fails, don't really care
-                      end
-                    end
-                  end
+                  find_subdomains root_domain, resv
                 end
               end
 
@@ -160,6 +123,51 @@ module Yawast
             end
           end
 
+          def self.find_srv(root_domain, resv)
+            File.open(File.dirname(__FILE__) + '/../../../resources/srv_list.txt', 'r') do |f|
+              f.each_line do |line|
+                host = line.strip + '.' + root_domain
+                begin
+                  srv = resv.getresources(host, Resolv::DNS::Resource::IN::SRV)
+
+                  unless srv.empty?
+                    srv.each do |rec|
+                      ip = resv.getaddress rec.target
+
+                      Yawast::Utilities.puts_info "\t\tSRV: #{host}: #{rec.target}:#{rec.port} - #{ip} (#{get_network_info(ip.to_s)})"
+                    end
+                  end
+                rescue
+                  #if this fails, don't really care
+                end
+              end
+            end
+          end
+
+          def self.find_subdomains(root_domain, resv)
+            File.open(File.dirname(__FILE__) + '/../../../resources/subdomain_list.txt', 'r') do |f|
+              f.each_line do |line|
+                host = line.strip + '.' + root_domain
+
+                begin
+                  a = resv.getresources(host, Resolv::DNS::Resource::IN::A)
+
+                  unless a.empty?
+                    a.each do |ip|
+                      if IPAddr.new(ip.address.to_s, Socket::AF_INET).private?
+                        Yawast::Utilities.puts_info "\t\tA: #{host}: #{ip.address}"
+                      else
+                        Yawast::Utilities.puts_info "\t\tA: #{host}: #{ip.address} (#{get_network_info(ip.address)})"
+                      end
+                    end
+                  end
+                rescue
+                  #if this fails, don't really care
+                end
+              end
+            end
+          end
+
           def self.get_network_info(ip)
             #check to see if we have this one cached
             @netinfo = Hash.new if @netinfo == nil
@@ -171,7 +179,7 @@ module Yawast
             return 'Network Information disabled due to prior failure' if @netinfo_failed
 
             begin
-              network_info = JSON.parse(Net::HTTP.get(URI("https://api.iptoasn.com/v1/as/ip/#{ip}")))
+              network_info = Yawast::Shared::Http.get_json URI("https://api.iptoasn.com/v1/as/ip/#{ip}")
 
               ret = "#{network_info['as_country_code']} - #{network_info['as_description']}"
               @netinfo[ip] = ret

data/lib/scanner/plugins/servers/apache.rb

@@ -47,6 +47,7 @@ module Yawast
             check_tomcat_manager(uri.copy)
             check_tomcat_version(uri.copy)
             check_tomcat_put_rce(uri.copy)
+            check_struts2_samples(uri.copy)
           end
 
           def self.check_server_status(uri)
@@ -140,12 +141,33 @@ module Yawast
             Yawast::Shared::Http.put(uri, req_data)
 
             # check to see of we get check_value back
+            uri.path = uri.path.chomp('/')
             res = Yawast::Shared::Http.get(uri)
             if res.include? check_value
               Yawast::Utilities.puts_vuln "Apache Tomcat PUT RCE (CVE-2017-12615): #{uri}"
             end
           end
 
+          def self.check_struts2_samples(uri)
+            search = Array.new
+            search.push '/Struts2XMLHelloWorld/User/home.action'
+            search.push '/struts2-showcase/showcase.action'
+            search.push '/struts2-showcase/titles/index.action'
+            search.push '/struts2-bootstrap-showcase/'
+            search.push '/struts2-showcase/index.action'
+            search.push '/struts2-bootstrap-showcase/index.action'
+            search.push '/struts2-rest-showcase/'
+
+            search.each do |path|
+              uri.path = path
+
+              ret = Yawast::Shared::Http.get_status_code uri
+              if ret == 200
+                Yawast::Utilities.puts_warn "Apache Struts2 Sample Files: #{uri}"
+              end
+            end
+          end
+
           def self.check_page_for_string(uri, path, search)
             uri.path = path
             uri.query = '' if uri.query != nil

data/lib/scanner/plugins/ssl/ssl.rb

@@ -0,0 +1,55 @@
+module Yawast
+  module Scanner
+    module Plugins
+      module SSL
+        class SSL
+          def self.print_precert(cert)
+            scts = cert.extensions.find {|e| e.oid == 'ct_precert_scts'}
+
+            unless scts.nil?
+              Yawast::Utilities.puts_info "\t\tSCTs:"
+              scts.value.split("\n").each { |line| puts "\t\t\t#{line}" }
+            end
+          end
+
+          def self.print_cert_hash(cert)
+            hash = Digest::SHA1.hexdigest(cert.to_der)
+            Yawast::Utilities.puts_info "\t\tHash: #{hash}"
+            puts "\t\t\thttps://censys.io/certificates?q=#{hash}"
+            puts "\t\t\thttps://crt.sh/?q=#{hash}"
+          end
+
+          def self.check_hsts(head)
+            found = ''
+
+            head.each do |k, v|
+              if k.downcase.include? 'strict-transport-security'
+                found = "#{k}: #{v}"
+              end
+            end
+
+            if found == ''
+              Yawast::Utilities.puts_warn 'HSTS: Not Enabled'
+            else
+              Yawast::Utilities.puts_info "HSTS: Enabled (#{found})"
+            end
+          end
+
+          def self.check_hsts_preload(uri)
+            begin
+              info = Yawast::Shared::Http.get_json URI("https://hstspreload.com/api/v1/status/#{uri.host}")
+
+              chrome = info['chrome'] != nil
+              firefox = info['firefox'] != nil
+              tor = info['tor'] != nil
+
+              Yawast::Utilities.puts_info "HSTS Preload: Chrome - #{chrome}; Firefox - #{firefox}; Tor - #{tor}"
+            rescue => e
+              Yawast::Utilities.puts_error "Error getting HSTS preload information: #{e.message}"
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/scanner/plugins/ssl/ssl_labs/analyze.rb

@@ -5,18 +5,53 @@ module Yawast
     module Plugins
       module SSL
         module SSLLabs
+          # setup exception classes
+          class InvocationError < StandardError; end
+          class RequestRateTooHigh < StandardError; end
+          class InternalError < StandardError; end
+          class ServiceNotAvailable < StandardError; end
+          class ServiceOverloaded < StandardError; end
+
           class Analyze
-            def self.scan(endpoint, target, startNew)
+            def self.scan(endpoint, target, start_new)
               uri = endpoint.copy
               uri.path = '/api/v3/analyze'
 
-              if startNew
+              if start_new
                 uri.query = "host=#{target}&publish=off&startNew=on&all=done&ignoreMismatch=on"
               else
                 uri.query = "host=#{target}&publish=off&all=done&ignoreMismatch=on"
               end
 
-              body = Yawast::Shared::Http.get uri
+              req = Yawast::Shared::Http.get_http(uri)
+              req.use_ssl = uri.scheme == 'https'
+              res = req.request_get(uri, { 'User-Agent' => "YAWAST/#{Yawast::VERSION}" })
+              body = res.read_body
+              code = res.code.to_i
+
+              # check for error in the response - if we don't, we'll wait forever for nothing
+              json = JSON.parse body
+              if json.key?('errors')
+                raise InvocationError, "API returned: #{json['errors']}"
+              end
+
+              # check the response code, make sure it's 200 - otherwise, we should stop now
+              if code != 200
+                case code
+                  when 400
+                    raise InvocationError, 'invalid parameters'
+                  when 429
+                    raise RequestRateTooHigh, 'request rate is too high, please slow down'
+                  when 500
+                    raise InternalError, 'service encountered an error, sleep 5 minutes'
+                  when 503
+                    raise ServiceNotAvailable, 'service is not available, sleep 15 minutes'
+                  when 529
+                    raise ServiceOverloaded, 'service is overloaded, sleep 30 minutes'
+                  else
+                    raise StandardError, "http error code #{r.code}"
+                end
+              end
 
               return body
             end

data/lib/scanner/plugins/ssl/sweet32.rb

@@ -3,12 +3,13 @@ module Yawast
     module Plugins
       module SSL
         class Sweet32
-          def self.get_tdes_session_msg_count(uri)
+          def self.get_tdes_session_msg_count(uri, limit = 10000)
             # this method will send a number of HEAD requests to see
             #  if the connection is eventually killed.
-            unless check_tdes(uri)
+            unless check_tdes
               #if the OpenSSL install doesn't support 3DES, bailout
               Yawast::Utilities.puts_error "Your copy of OpenSSL doesn't support 3DES cipher suites - SWEET32 test aborted."
+              puts '  See here for more information: https://github.com/adamcaudill/yawast/wiki/OpenSSL-&-3DES-Compatibility'
               return
             end
 
@@ -84,7 +85,7 @@ module Yawast
 
               req.start do |http|
                 #cache the number of hits
-                10000.times do |i|
+                limit.times do |i|
                   if use_head
                     http.head(uri.path, headers)
                   else
@@ -116,20 +117,13 @@ module Yawast
             end
 
             puts
-            Yawast::Utilities.puts_vuln 'TLS Session Request Limit: Connection not terminated after 10,000 requests; possibly vulnerable to SWEET32'
+            limit_formatted = limit.to_s.reverse.gsub(/(\d{3})(?=\d)/, '\\1,').reverse
+            Yawast::Utilities.puts_vuln "TLS Session Request Limit: Connection not terminated after #{limit_formatted} requests; possibly vulnerable to SWEET32"
           end
 
-          def self.check_tdes(uri)
+          def self.check_tdes
             puts 'Confirming your OpenSSL supports 3DES cipher suites...'
 
-            dns = Resolv::DNS.new
-
-            if IPAddress.valid? uri.host
-              ip = IPAddress.parse uri.host
-            else
-              ip = dns.getaddresses(uri.host)[0]
-            end
-
             #find all versions that don't include '_server' or '_client'
             versions = OpenSSL::SSL::SSLContext::METHODS.find_all { |v| !v.to_s.include?('_client') && !v.to_s.include?('_server')}
 

data/lib/scanner/ssl.rb

@@ -68,12 +68,8 @@ module Yawast
         Yawast::Utilities.puts_info "\t\tExtensions:"
         cert.extensions.each { |ext| Yawast::Utilities.puts_info "\t\t\t#{ext}" unless ext.oid == 'subjectAltName' || ext.oid == 'ct_precert_scts' }
 
-        #ct_precert_scts
-        scts = cert.extensions.find {|e| e.oid == 'ct_precert_scts'}
-        unless scts.nil?
-          Yawast::Utilities.puts_info "\t\tSCTs:"
-          scts.value.split("\n").each { |line| puts "\t\t\t#{line}" }
-        end
+        # ct_precert_scts
+        Yawast::Scanner::Plugins::SSL::SSL.print_precert cert
 
         #alt names
         alt_names = cert.extensions.find {|e| e.oid == 'subjectAltName'}
@@ -82,11 +78,9 @@ module Yawast
           alt_names.value.split(',').each { |name| Yawast::Utilities.puts_info "\t\t\t#{name.strip.delete('DNS:')}" }
         end
 
-        hash = Digest::SHA1.hexdigest(cert.to_der)
-        Yawast::Utilities.puts_info "\t\tHash: #{hash}"
-        puts "\t\t\thttps://censys.io/certificates?q=#{hash}"
-        puts "\t\t\thttps://crt.sh/?q=#{hash}"
-        puts ''
+        Yawast::Scanner::Plugins::SSL::SSL.print_cert_hash cert
+
+        puts
       end
 
       def self.get_cert_chain_info(cert_chain, cert)
@@ -173,36 +167,6 @@ module Yawast
         end
       end
 
-      def self.check_hsts(head)
-        found = ''
-
-        head.each do |k, v|
-          if k.downcase.include? 'strict-transport-security'
-            found = "#{k}: #{v}"
-          end
-        end
-
-        if found == ''
-          Yawast::Utilities.puts_warn 'HSTS: Not Enabled'
-        else
-          Yawast::Utilities.puts_info "HSTS: Enabled (#{found})"
-        end
-      end
-
-      def self.check_hsts_preload(uri)
-        begin
-          info = JSON.parse(Net::HTTP.get(URI("https://hstspreload.com/api/v1/status/#{uri.host}")))
-
-          chrome = info['chrome'] != nil
-          firefox = info['firefox'] != nil
-          tor = info['tor'] != nil
-
-          Yawast::Utilities.puts_info "HSTS Preload: Chrome - #{chrome}; Firefox - #{firefox}; Tor - #{tor}"
-        rescue => e
-          Yawast::Utilities.puts_error "Error getting HSTS preload information: #{e.message}"
-        end
-      end
-
       #private methods
       class << self
         private

data/lib/scanner/ssl_labs.rb

@@ -11,7 +11,7 @@ module Yawast
         puts 'Beginning SSL Labs scan (this could take a minute or two)'
 
         begin
-          endpoint = Yawast::Commands::Utils.extract_uri(['https://api.ssllabs.com'])
+          endpoint = URI::Parser.new.parse 'https://api.ssllabs.com'
 
           info_body = Yawast::Scanner::Plugins::SSL::SSLLabs::Info.call_info endpoint
 
@@ -215,12 +215,12 @@ module Yawast
         end
 
         Yawast::Utilities.puts_info "\t\tExtensions:"
-        ossl_cert.extensions.each { |ext| Yawast::Utilities.puts_info "\t\t\t#{ext}" unless ext.oid == 'subjectAltName' }
+        ossl_cert.extensions.each { |ext| Yawast::Utilities.puts_info "\t\t\t#{ext}" unless ext.oid == 'subjectAltName' || ext.oid == 'ct_precert_scts' }
 
-        hash = Digest::SHA1.hexdigest(ossl_cert.to_der)
-        Yawast::Utilities.puts_info "\t\tHash: #{hash}"
-        puts "\t\t\thttps://censys.io/certificates?q=#{hash}"
-        puts "\t\t\thttps://crt.sh/?q=#{hash}"
+        # ct_precert_scts
+        Yawast::Scanner::Plugins::SSL::SSL.print_precert ossl_cert
+
+        Yawast::Scanner::Plugins::SSL::SSL.print_cert_hash ossl_cert
 
         puts
         Yawast::Utilities.puts_info "\t\tCertificate Chains:"
@@ -263,10 +263,12 @@ module Yawast
         puts
 
         puts "\t\tNamed Group Support:"
-        ep['details']['namedGroups']['list'].each do |group|
-          Yawast::Utilities.puts_info "\t\t\t#{group['name']} #{group['bits']}"
+        if ep['details']['namedGroups'] != nil
+          ep['details']['namedGroups']['list'].each do |group|
+            Yawast::Utilities.puts_info "\t\t\t#{group['name']} #{group['bits']}"
+          end
+          puts
         end
-        puts
 
         puts "\t\tCipher Suite Support:"
         if ep['details']['suites'] != nil
@@ -381,7 +383,7 @@ module Yawast
           when 2
             Yawast::Utilities.puts_vuln "\t\t\tPOODLE (TLS): Vulnerable"
           else
-            Yawast::Utilities.puts_error "\t\t\tPOODLE (TLS): Unknown Response #{ep['details'].poodle_tls}"
+            Yawast::Utilities.puts_error "\t\t\tPOODLE (TLS): Unknown Response #{ep['details']['poodleTls']}"
         end
 
         if ep['details']['fallbackScsv']
@@ -396,12 +398,31 @@ module Yawast
           Yawast::Utilities.puts_info "\t\t\tCompression: No"
         end
 
+        if ep['details']['heartbeat']
+          Yawast::Utilities.puts_warn "\t\t\tHeartbeat: Enabled"
+        else
+          Yawast::Utilities.puts_info "\t\t\tHeartbeat: Disabled"
+        end
+
         if ep['details']['heartbleed']
           Yawast::Utilities.puts_vuln "\t\t\tHeartbleed: Vulnerable"
         else
           Yawast::Utilities.puts_info "\t\t\tHeartbleed: No"
         end
 
+        case ep['details']['ticketbleed']
+          when -1
+            Yawast::Utilities.puts_error "\t\t\tTicketbleed (CVE-2016-9244): Test Failed"
+          when 0
+            Yawast::Utilities.puts_error "\t\t\tTicketbleed (CVE-2016-9244): Test Failed (Unknown)"
+          when 1
+            Yawast::Utilities.puts_info "\t\t\tTicketbleed (CVE-2016-9244): No"
+          when 2
+            Yawast::Utilities.puts_vuln "\t\t\tTicketbleed (CVE-2016-9244): Vulnerable"
+          else
+            Yawast::Utilities.puts_error "\t\t\tOpenSSL CCS (CVE-2014-0224): Unknown Response #{ep['details']['ticketbleed']}"
+        end
+
         case ep['details']['openSslCcs']
           when -1
             Yawast::Utilities.puts_error "\t\t\tOpenSSL CCS (CVE-2014-0224): Test Failed"
@@ -414,7 +435,7 @@ module Yawast
           when 3
             Yawast::Utilities.puts_vuln "\t\t\tOpenSSL CCS (CVE-2014-0224): Vulnerable"
           else
-            Yawast::Utilities.puts_error "\t\t\tOpenSSL CCS (CVE-2014-0224): Unknown Response #{ep['details'].open_ssl_ccs}"
+            Yawast::Utilities.puts_error "\t\t\tOpenSSL CCS (CVE-2014-0224): Unknown Response #{ep['details']['openSslCcs']}"
         end
 
         case ep['details']['openSSLLuckyMinus20']
@@ -440,41 +461,39 @@ module Yawast
           Yawast::Utilities.puts_vuln "\t\t\tForward Secrecy: No"
         end
 
-        if ep['details']['ocspStapling']
-          Yawast::Utilities.puts_info "\t\t\tOCSP Stapling: Yes"
-        else
-          Yawast::Utilities.puts_warn "\t\t\tOCSP Stapling: No"
-        end
-
-        if ep['details']['freak']
-          Yawast::Utilities.puts_vuln "\t\t\tFREAK: Vulnerable"
-        else
-          Yawast::Utilities.puts_info "\t\t\tFREAK: No"
-        end
+        Yawast::Utilities.puts_info "\t\t\tALPN: #{ep['details']['alpnProtocols']}"
 
-        if ep['details']['logjam']
-          Yawast::Utilities.puts_vuln "\t\t\tLogjam: Vulnerable"
-        else
-          Yawast::Utilities.puts_info "\t\t\tLogjam: No"
-        end
+        Yawast::Utilities.puts_info "\t\t\tNPN: #{ep['details']['npnProtocols']}"
 
-        case ep['details']['dhUsesKnownPrimes']
+        case ep['details']['sessionResumption']
           when 0
-            Yawast::Utilities.puts_info "\t\t\tUses common DH primes: No"
+            Yawast::Utilities.puts_info "\t\t\tSession Resumption: Not Enabled / Empty Tickets"
           when 1
-            Yawast::Utilities.puts_warn "\t\t\tUses common DH primes: Yes (not weak)"
+            Yawast::Utilities.puts_info "\t\t\tSession Resumption: Enabled / No Resumption"
           when 2
-            Yawast::Utilities.puts_vuln "\t\t\tUses common DH primes: Yes (weak)"
+            Yawast::Utilities.puts_warn "\t\t\tSession Resumption: Enabled"
           else
-            unless ep['details']['dhUsesKnownPrimes'] == nil
-              Yawast::Utilities.puts_error "\t\t\tUses common DH primes: Unknown Response #{ep['details']['dhUsesKnownPrimes']}"
-            end
+            Yawast::Utilities.puts_error "\t\t\tSession Resumption: Unknown Response #{ep['details']['sessionResumption']}"
         end
 
-        if ep['details']['dhYsReuse']
-          Yawast::Utilities.puts_vuln "\t\t\tDH public server param (Ys) reuse: Yes"
+        if ep['details']['ocspStapling']
+          Yawast::Utilities.puts_info "\t\t\tOCSP Stapling: Yes"
         else
-          Yawast::Utilities.puts_info "\t\t\tDH public server param (Ys) reuse: No"
+          Yawast::Utilities.puts_warn "\t\t\tOCSP Stapling: No"
+        end
+
+        if ep['details']['miscIntolerance'] > 0
+          if ep['details']['miscIntolerance'] & 1 != 0
+            Yawast::Utilities.puts_warn "\t\t\tTLS Extension Intolerance: Yes"
+          end
+
+          if ep['details']['miscIntolerance'] & (1<<1) != 0
+            Yawast::Utilities.puts_warn "\t\t\tLong Handshake Intolerance: Yes"
+          end
+
+          if ep['details']['miscIntolerance'] & (1<<2) != 0
+            Yawast::Utilities.puts_warn "\t\t\tLong Handshake Intolerance: Workaround Success"
+          end
         end
 
         if ep['details']['protocolIntolerance'] > 0
@@ -505,6 +524,43 @@ module Yawast
           Yawast::Utilities.puts_info "\t\t\tProtocol Intolerance: No"
         end
 
+        if ep['details']['freak']
+          Yawast::Utilities.puts_vuln "\t\t\tFREAK: Vulnerable (512-bit key exchange supported)"
+        else
+          Yawast::Utilities.puts_info "\t\t\tFREAK: No"
+        end
+
+        if ep['details']['logjam']
+          Yawast::Utilities.puts_vuln "\t\t\tLogjam: Vulnerable (DH key exchange with keys smaller than 1024 bits)"
+        else
+          Yawast::Utilities.puts_info "\t\t\tLogjam: No"
+        end
+
+        case ep['details']['dhUsesKnownPrimes']
+          when 0
+            Yawast::Utilities.puts_info "\t\t\tUses common DH primes: No"
+          when 1
+            Yawast::Utilities.puts_warn "\t\t\tUses common DH primes: Yes (not weak)"
+          when 2
+            Yawast::Utilities.puts_vuln "\t\t\tUses common DH primes: Yes (weak)"
+          else
+            unless ep['details']['dhUsesKnownPrimes'] == nil
+              Yawast::Utilities.puts_error "\t\t\tUses common DH primes: Unknown Response #{ep['details']['dhUsesKnownPrimes']}"
+            end
+        end
+
+        if ep['details']['dhYsReuse']
+          Yawast::Utilities.puts_vuln "\t\t\tDH public server param (Ys) reuse: Yes"
+        else
+          Yawast::Utilities.puts_info "\t\t\tDH public server param (Ys) reuse: No"
+        end
+
+        if ep['details']['ecdhParameterReuse']
+          Yawast::Utilities.puts_vuln "\t\t\tECDH Public Server Param Reuse: Yes"
+        else
+          Yawast::Utilities.puts_info "\t\t\tECDH Public Server Param Reuse: No"
+        end
+
         puts
       end
 

data/lib/shared/http.rb

@@ -1,4 +1,5 @@
 require 'securerandom'
+require 'json'
 
 module Yawast
   module Shared
@@ -47,6 +48,21 @@ module Yawast
         body
       end
 
+      def self.get_json(uri)
+        body = ''
+
+        begin
+          req = get_http(uri)
+          req.use_ssl = uri.scheme == 'https'
+          res = req.request_get(uri, { 'User-Agent' => "YAWAST/#{Yawast::VERSION}" })
+          body = res.read_body
+        rescue
+          #do nothing for now
+        end
+
+        JSON.parse body
+      end
+
       def self.put(uri, body, headers = nil)
         begin
           req = get_http(uri)

data/lib/version.rb

@@ -1,3 +1,3 @@
 module Yawast
-  VERSION = '0.6.0.beta4'
+  VERSION = '0.6.0.beta5'
 end

data/lib/yawast.rb

@@ -25,7 +25,7 @@ require_all '/shared'
 
 module Yawast
   DESCRIPTION = 'The YAWAST Antecedent Web Application Security Toolkit'
-  HTTP_UA = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_1) AppleWebKit/537.36 (KHTML, like Gecko) Yawast/#{VERSION} Chrome/56.0.2924.28 Safari/537.36"
+  HTTP_UA = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_3) AppleWebKit/537.36 (KHTML, like Gecko) YAWAST/#{VERSION} Chrome/61.0.3163.100 Safari/537.36"
 
   def self.header
     puts '__   _____  _    _  ___   _____ _____ '
@@ -41,7 +41,7 @@ module Yawast
     puts " Ruby #{RUBY_VERSION}-p#{RUBY_PATCHLEVEL}; #{OpenSSL::OPENSSL_VERSION} (#{RUBY_PLATFORM})"
 
     begin
-      version = JSON.parse(Net::HTTP.get(URI('https://rubygems.org/api/v1/versions/yawast/latest.json')))['version']
+      version = Yawast::Shared::Http.get_json(URI('https://rubygems.org/api/v1/versions/yawast/latest.json'))['version']
 
       if version != VERSION
         puts " Latest Version: YAWAST v#{version} is the officially supported version, please update.".blue

data/test/data/hsts_disabled_server_header.txt

@@ -0,0 +1,16 @@
+HTTP/1.1 200 OK
+Date: Sun, 22 Oct 2017 22:44:34 GMT
+Content-Type: text/html; charset=UTF-8
+Connection: keep-alive
+Set-Cookie: __cfduid=d1f8c33f1dccb58e367a4570c63ac5ce41508712274; expires=Mon, 22-Oct-18 22:44:34 GMT; path=/; domain=.adamcaudill.com; HttpOnly; Secure
+Vary: Accept-Encoding,Cookie
+Last-Modified: Fri, 13 Oct 2017 19:39:19 GMT
+X-Content-Type-Options: nosniff
+X-Frame-Options: sameorigin
+Pragma: public
+Cache-Control: public, max-age=86400
+CF-Cache-Status: HIT
+Expires: Mon, 23 Oct 2017 22:44:34 GMT
+Server: cloudflare-nginx
+CF-RAY: 3b1ffb6499c12ea5-MIA
+

data/test/data/hsts_server_header.txt

@@ -0,0 +1,17 @@
+HTTP/1.1 200 OK
+Date: Sun, 22 Oct 2017 22:44:34 GMT
+Content-Type: text/html; charset=UTF-8
+Connection: keep-alive
+Set-Cookie: __cfduid=d1f8c33f1dccb58e367a4570c63ac5ce41508712274; expires=Mon, 22-Oct-18 22:44:34 GMT; path=/; domain=.adamcaudill.com; HttpOnly; Secure
+Vary: Accept-Encoding,Cookie
+Last-Modified: Fri, 13 Oct 2017 19:39:19 GMT
+X-Content-Type-Options: nosniff
+X-Frame-Options: sameorigin
+Pragma: public
+Cache-Control: public, max-age=86400
+CF-Cache-Status: HIT
+Expires: Mon, 23 Oct 2017 22:44:34 GMT
+Strict-Transport-Security: max-age=15552000; preload
+Server: cloudflare-nginx
+CF-RAY: 3b1ffb6499c12ea5-MIA
+