@soulofzephir/pi-skill-pentesting 1.0.0

package/skills/pentesting/tools/header-scan.ps1

@@ -0,0 +1,202 @@
+# Security Header Scanner (PowerShell Version)
+# Usage: .\header-scan.ps1 https://target.com
+
+param(
+    [Parameter(Mandatory=$false)]
+    [string]$Target = "https://example.com"
+)
+
+$ErrorActionPreference = "SilentlyContinue"
+$Score = 0
+$MaxScore = 100
+
+Write-Host "========================================" -ForegroundColor Cyan
+Write-Host "🔒 Security Header Scanner" -ForegroundColor Cyan
+Write-Host "Target: $Target" -ForegroundColor Cyan
+Write-Host "========================================" -ForegroundColor Cyan
+Write-Host ""
+
+# Get headers
+try {
+    $Headers = Invoke-WebRequest -Uri $Target -Method Head -UserAgent "SecurityScanner/1.0" -MaximumFollowRelLink 5 -ErrorAction Stop
+    $AllHeaders = $Headers.Headers
+} catch {
+    Write-Host "❌ Error connecting to target: $_" -ForegroundColor Red
+    exit 1
+}
+
+Write-Host "📋 Response Headers:" -ForegroundColor Yellow
+$AllHeaders | Format-Table -AutoSize
+Write-Host ""
+
+# Helper function
+function Test-Header {
+    param($Name, $Pattern)
+    return $AllHeaders.Keys | Where-Object { $_ -match $Pattern }
+}
+
+# Check HSTS
+$hsts = $AllHeaders.Keys | Where-Object { $_ -like "*strict-transport*" }
+if ($hsts) {
+    $hstsValue = $AllHeaders[$hsts]
+    if ($hstsValue -match "max-age=([3-9]\d{5,}|\d{7,})") {
+        Write-Host "✅ HSTS: Good (max-age >= 1 year)" -ForegroundColor Green
+        $Score += 15
+    } elseif ($hstsValue -match "max-age=(\d{5,6})") {
+        Write-Host "⚠️  HSTS: Medium (max-age too short)" -ForegroundColor Yellow
+        $Score += 8
+    } else {
+        Write-Host "⚠️  HSTS: Present but check max-age value" -ForegroundColor Yellow
+        $Score += 5
+    }
+} else {
+    Write-Host "❌ HSTS: Missing" -ForegroundColor Red
+}
+
+# Check CSP
+$cspKeys = $AllHeaders.Keys | Where-Object { $_ -like "*content-security*" }
+if ($cspKeys) {
+    Write-Host "✅ CSP: Present" -ForegroundColor Green
+    foreach ($key in $cspKeys) {
+        $cspValue = $AllHeaders[$key]
+        if ($cspValue -match "'unsafe-inline'") {
+            Write-Host "   ⚠️  CSP contains 'unsafe-inline' (XSS risk)" -ForegroundColor Red
+        }
+        if ($cspValue -match "'unsafe-eval'") {
+            Write-Host "   ⚠️  CSP contains 'unsafe-eval'" -ForegroundColor Red
+        }
+        if ($cspValue -match "frame-ancestors") {
+            Write-Host "   ✅ frame-ancestors directive present" -ForegroundColor Green
+        }
+        if ($cspValue -notmatch "'unsafe-" -and $cspValue -notmatch "\*") {
+            Write-Host "   ✅ No dangerous CSP directives" -ForegroundColor Green
+            $Score += 20
+        }
+    }
+} else {
+    Write-Host "❌ CSP: Missing (XSS/clickjacking risk)" -ForegroundColor Red
+}
+
+# Check X-Content-Type-Options
+$xctoKeys = $AllHeaders.Keys | Where-Object { $_ -like "*x-content-type*" }
+if ($xctoKeys) {
+    $xctoValue = $AllHeaders[$xctoKeys[0]]
+    if ($xctoValue -eq "nosniff") {
+        Write-Host "✅ X-Content-Type-Options: nosniff" -ForegroundColor Green
+        $Score += 10
+    } else {
+        Write-Host "⚠️  X-Content-Type-Options: Wrong value ($xctoValue)" -ForegroundColor Yellow
+    }
+} else {
+    Write-Host "❌ X-Content-Type-Options: Missing" -ForegroundColor Red
+}
+
+# Check X-Frame-Options
+$xfoKeys = $AllHeaders.Keys | Where-Object { $_ -like "*x-frame*" }
+if ($xfoKeys) {
+    $xfoValue = $AllHeaders[$xfoKeys[0]]
+    if ($xfoValue -eq "DENY") {
+        Write-Host "✅ X-Frame-Options: DENY" -ForegroundColor Green
+        $Score += 10
+    } elseif ($xfoValue -eq "SAMEORIGIN") {
+        Write-Host "✅ X-Frame-Options: SAMEORIGIN" -ForegroundColor Green
+        $Score += 8
+    } elseif ($xfoValue -eq "ALLOWALL") {
+        Write-Host "❌ X-Frame-Options: ALLOWALL (Dangerous!)" -ForegroundColor Red
+    } else {
+        Write-Host "⚠️  X-Frame-Options: $xfoValue" -ForegroundColor Yellow
+    }
+} else {
+    Write-Host "❌ X-Frame-Options: Missing (Clickjacking risk)" -ForegroundColor Red
+}
+
+# Check Referrer-Policy
+$rpKeys = $AllHeaders.Keys | Where-Object { $_ -like "*referrer*" }
+if ($rpKeys) {
+    Write-Host "✅ Referrer-Policy: Present" -ForegroundColor Green
+    $rpValue = $AllHeaders[$rpKeys[0]]
+    if ($rpValue -match "unsafe-url") {
+        Write-Host "   ⚠️  Contains 'unsafe-url' (leaks referrer)" -ForegroundColor Red
+    }
+    $Score += 10
+} else {
+    Write-Host "⚠️  Referrer-Policy: Missing" -ForegroundColor Yellow
+}
+
+# Check Permissions-Policy
+$ppKeys = $AllHeaders.Keys | Where-Object { $_ -like "*permissions*" }
+if ($ppKeys) {
+    Write-Host "✅ Permissions-Policy: Present" -ForegroundColor Green
+    $Score += 10
+} else {
+    Write-Host "⚠️  Permissions-Policy: Missing (recommended)" -ForegroundColor Yellow
+}
+
+# Check Cache-Control
+Write-Host ""
+Write-Host "🔍 Testing Cache-Control..." -ForegroundColor Yellow
+$ccKeys = $AllHeaders.Keys | Where-Object { $_ -like "*cache*" }
+if ($ccKeys) {
+    $ccValue = $AllHeaders[$ccKeys[0]]
+    if ($ccValue -match "no-store|no-cache") {
+        Write-Host "✅ Cache-Control: Secure" -ForegroundColor Green
+        $Score += 10
+    } elseif ($ccValue -match "private") {
+        Write-Host "⚠️  Cache-Control: private (not optimal)" -ForegroundColor Yellow
+        $Score += 5
+    } else {
+        Write-Host "⚠️  Cache-Control: Check if sensitive data cached" -ForegroundColor Yellow
+    }
+} else {
+    Write-Host "⚠️  Cache-Control: Not found" -ForegroundColor Yellow
+}
+
+# Check Server header
+$serverKeys = $AllHeaders.Keys | Where-Object { $_ -like "server" }
+if ($serverKeys) {
+    $serverValue = $AllHeaders[$serverKeys[0]]
+    if ($serverValue -match "Apache/\d|nginx/\d|IIS/\d|Apache-Advanced|Server version") {
+        Write-Host "❌ Server header leaks version: $serverValue" -ForegroundColor Red
+        Write-Host "   Recommendation: Hide version info" -ForegroundColor Gray
+    } elseif ($serverValue -match "Apache|nginx|IIS") {
+        Write-Host "⚠️  Server header: $serverValue" -ForegroundColor Yellow
+    }
+}
+
+# Check X-Powered-By
+$pwKeys = $AllHeaders.Keys | Where-Object { $_ -like "*x-powered-by*" }
+if ($pwKeys) {
+    $pwValue = $AllHeaders[$pwKeys[0]]
+    Write-Host "❌ X-Powered-By leaks info: $pwValue" -ForegroundColor Red
+    Write-Host "   Recommendation: Remove this header" -ForegroundColor Gray
+}
+
+# Check debug headers
+$debugKeys = $AllHeaders.Keys | Where-Object { $_ -match "debug|x-source-map|sourcemap" }
+if ($debugKeys) {
+    Write-Host "❌ Debug/Sourcemap headers present" -ForegroundColor Red
+}
+
+# Calculate grade
+Write-Host ""
+Write-Host "========================================" -ForegroundColor Cyan
+Write-Host "📊 Security Header Score: $Score/100" -ForegroundColor Cyan
+Write-Host "========================================" -ForegroundColor Cyan
+
+if ($Score -ge 90) {
+    Write-Host "Grade: A (Excellent)" -ForegroundColor Green
+} elseif ($Score -ge 70) {
+    Write-Host "Grade: B (Good)" -ForegroundColor Green
+} elseif ($Score -ge 50) {
+    Write-Host "Grade: C (Needs Improvement)" -ForegroundColor Yellow
+} elseif ($Score -ge 30) {
+    Write-Host "Grade: D (Poor)" -ForegroundColor Red
+} else {
+    Write-Host "Grade: F (Critical Issues)" -ForegroundColor Red
+}
+
+Write-Host ""
+Write-Host "🔗 Online Scanners:" -ForegroundColor Cyan
+Write-Host "   https://securityheaders.com/?q=$Target"
+Write-Host "   https://observatory.mozilla.org/analyze/$Target"
+Write-Host ""

package/skills/pentesting/tools/header-scan.sh

@@ -0,0 +1,173 @@
+#!/bin/bash
+# Security Header Scanner v1.0
+# Usage: ./header-scan.sh https://target.com
+
+TARGET=${1:-https://example.com}
+SCORE=0
+MAX_SCORE=100
+
+echo "========================================"
+echo "🔒 Security Header Scanner"
+echo "Target: $TARGET"
+echo "========================================"
+echo ""
+
+# Color codes
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+NC='\033[0m' # No Color
+
+# Get headers
+HEADERS=$(curl -I -s -L -A "SecurityScanner/1.0" "$TARGET" 2>/dev/null)
+
+echo "📋 Response Headers:"
+echo "$HEADERS"
+echo ""
+
+# Check HSTS
+if echo "$HEADERS" | grep -qi "strict-transport-security"; then
+    HSTS=$(echo "$HEADERS" | grep -i "strict-transport-security" | head -1)
+    if echo "$HSTS" | grep -qi "max-age=[3-9][0-9]{5,}"; then
+        echo -e "${GREEN}✅ HSTS: Good (max-age ≥ 1 year)${NC}"
+        SCORE=$((SCORE + 15))
+    elif echo "$HSTS" | grep -qi "max-age=[1-2][0-9]{5,}"; then
+        echo -e "${YELLOW}⚠️  HSTS: Medium (max-age too short)${NC}"
+        SCORE=$((SCORE + 8))
+    else
+        echo -e "${RED}❌ HSTS: Weak (max-age < 1 year)${NC}"
+    fi
+else
+    echo -e "${RED}❌ HSTS: Missing${NC}"
+fi
+
+# Check CSP
+if echo "$HEADERS" | grep -qi "content-security-policy"; then
+    CSP=$(echo "$HEADERS" | grep -i "content-security-policy" | head -1)
+    echo -e "${GREEN}✅ CSP: Present${NC}"
+    
+    if echo "$CSP" | grep -qi "'unsafe-inline'"; then
+        echo -e "${RED}   ⚠️  CSP contains 'unsafe-inline' (XSS risk)${NC}"
+    elif echo "$CSP" | grep -qi "'unsafe-eval'"; then
+        echo -e "${RED}   ⚠️  CSP contains 'unsafe-eval'${NC}"
+    else
+        echo -e "${GREEN}   ✅ No dangerous directives found${NC}"
+        SCORE=$((SCORE + 20))
+    fi
+    
+    if echo "$CSP" | grep -qi "frame-ancestors"; then
+        echo -e "${GREEN}   ✅ frame-ancestors directive present${NC}"
+    fi
+else
+    echo -e "${RED}❌ CSP: Missing (XSS/clickjacking risk)${NC}"
+fi
+
+# Check X-Content-Type-Options
+if echo "$HEADERS" | grep -qi "x-content-type-options"; then
+    if echo "$HEADERS" | grep -i "x-content-type-options" | grep -qi "nosniff"; then
+        echo -e "${GREEN}✅ X-Content-Type-Options: nosniff${NC}"
+        SCORE=$((SCORE + 10))
+    else
+        echo -e "${YELLOW}⚠️  X-Content-Type-Options: Present but wrong value${NC}"
+    fi
+else
+    echo -e "${RED}❌ X-Content-Type-Options: Missing${NC}"
+fi
+
+# Check X-Frame-Options
+if echo "$HEADERS" | grep -qi "x-frame-options"; then
+    XFO=$(echo "$HEADERS" | grep -i "x-frame-options" | head -1)
+    if echo "$XFO" | grep -qi "deny"; then
+        echo -e "${GREEN}✅ X-Frame-Options: DENY${NC}"
+        SCORE=$((SCORE + 10))
+    elif echo "$XFO" | grep -qi "sameorigin"; then
+        echo -e "${GREEN}✅ X-Frame-Options: SAMEORIGIN${NC}"
+        SCORE=$((SCORE + 8))
+    elif echo "$XFO" | grep -qi "allowall"; then
+        echo -e "${RED}❌ X-Frame-Options: ALLOWALL (Dangerous!)${NC}"
+    fi
+else
+    echo -e "${RED}❌ X-Frame-Options: Missing (Clickjacking risk)${NC}"
+fi
+
+# Check Referrer-Policy
+if echo "$HEADERS" | grep -qi "referrer-policy"; then
+    RP=$(echo "$HEADERS" | grep -i "referrer-policy" | head -1)
+    echo -e "${GREEN}✅ Referrer-Policy: Present${NC}"
+    SCORE=$((SCORE + 10))
+    
+    if echo "$RP" | grep -qi "unsafe-url"; then
+        echo -e "${RED}   ⚠️  Contains 'unsafe-url' (leaks referrer)${NC}"
+    fi
+else
+    echo -e "${YELLOW}⚠️  Referrer-Policy: Missing${NC}"
+fi
+
+# Check Permissions-Policy
+if echo "$HEADERS" | grep -qi "permissions-policy"; then
+    echo -e "${GREEN}✅ Permissions-Policy: Present${NC}"
+    SCORE=$((SCORE + 10))
+else
+    echo -e "${YELLOW}⚠️  Permissions-Policy: Missing (recommended)${NC}"
+fi
+
+# Check Cache-Control (test sensitive page)
+echo ""
+echo "🔍 Testing Cache-Control for sensitive data..."
+CACHE_CHECK=$(curl -I -s "$TARGET" 2>/dev/null | grep -i "cache-control")
+if echo "$CACHE_CHECK" | grep -qi "no-store\|no-cache"; then
+    echo -e "${GREEN}✅ Cache-Control: Secure${NC}"
+    SCORE=$((SCORE + 10))
+elif echo "$CACHE_CHECK" | grep -qi "private"; then
+    echo -e "${YELLOW}⚠️  Cache-Control: private (not optimal for shared caches)${NC}"
+    SCORE=$((SCORE + 5))
+else
+    echo -e "${YELLOW}⚠️  Cache-Control: Check if sensitive data is cached${NC}"
+fi
+
+# Check Server header (info leakage)
+if echo "$HEADERS" | grep -qi "^server:"; then
+    SERVER=$(echo "$HEADERS" | grep -i "^server:" | head -1)
+    if echo "$SERVER" | grep -qE "Apache/[0-9]|nginx/[0-9]|Microsoft-IIS/[0-9]"; then
+        echo -e "${RED}❌ Server header leaks version: $SERVER${NC}"
+        echo -e "${RED}   Recommendation: Hide version info${NC}"
+    elif echo "$SERVER" | grep -qiE "apache|nginx|microsoft"; then
+        echo -e "${YELLOW}⚠️  Server header: $(echo $SERVER | xargs)${NC}"
+        echo -e "${YELLOW}   Recommendation: Consider generic 'Server: webserver'${NC}"
+    fi
+fi
+
+# Check X-Powered-By
+if echo "$HEADERS" | grep -qi "x-powered-by"; then
+    POWERED=$(echo "$HEADERS" | grep -i "x-powered-by" | head -1)
+    echo -e "${RED}❌ X-Powered-By leaks info: $POWERED${NC}"
+    echo -e "${RED}   Recommendation: Remove this header${NC}"
+fi
+
+# Check for debug headers
+if echo "$HEADERS" | grep -qi "x-debug\|x-source-map\|sourcemap"; then
+    echo -e "${RED}❌ Debug/Sourcemap headers present${NC}"
+fi
+
+echo ""
+echo "========================================"
+echo "📊 Security Header Score: $SCORE/100"
+echo "========================================"
+
+if [ $SCORE -ge 90 ]; then
+    echo -e "${GREEN}Grade: A (Excellent)${NC}"
+elif [ $SCORE -ge 70 ]; then
+    echo -e "${GREEN}Grade: B (Good)${NC}"
+elif [ $SCORE -ge 50 ]; then
+    echo -e "${YELLOW}Grade: C (Needs Improvement)${NC}"
+elif [ $SCORE -ge 30 ]; then
+    echo -e "${RED}Grade: D (Poor)${NC}"
+else
+    echo -e "${RED}Grade: F (Critical Issues)${NC}"
+fi
+
+echo ""
+echo "🔗 Online Scanners:"
+echo "   - https://securityheaders.com/?q=$TARGET"
+echo "   - https://observatory.mozilla.org/analyze/$TARGET"
+echo ""