vamp-http-audit 1.0.0__tar.gz

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (12) hide show
  1. vamp_http_audit-1.0.0/PKG-INFO +171 -0
  2. vamp_http_audit-1.0.0/README.md +150 -0
  3. vamp_http_audit-1.0.0/pyproject.toml +34 -0
  4. vamp_http_audit-1.0.0/setup.cfg +4 -0
  5. vamp_http_audit-1.0.0/vamp_http_audit.egg-info/PKG-INFO +171 -0
  6. vamp_http_audit-1.0.0/vamp_http_audit.egg-info/SOURCES.txt +10 -0
  7. vamp_http_audit-1.0.0/vamp_http_audit.egg-info/dependency_links.txt +1 -0
  8. vamp_http_audit-1.0.0/vamp_http_audit.egg-info/entry_points.txt +2 -0
  9. vamp_http_audit-1.0.0/vamp_http_audit.egg-info/requires.txt +1 -0
  10. vamp_http_audit-1.0.0/vamp_http_audit.egg-info/top_level.txt +2 -0
  11. vamp_http_audit-1.0.0/vamp_http_audit.py +1799 -0
  12. vamp_http_audit-1.0.0/vampsec_report.py +959 -0
vamp_http_audit-1.0.0/PKG-INFO ADDED
@@ -0,0 +1,171 @@
1
+ Metadata-Version: 2.4
2
+ Name: vamp-http-audit
3
+ Version: 1.0.0
4
+ Summary: HTTP security headers and CORS auditor — CSP, HSTS, X-Frame-Options, Referrer-Policy, Permissions-Policy
5
+ Author-email: VampSecure Studios <contact@vampsecurestudios.com>
6
+ License: MIT
7
+ Project-URL: Homepage, https://github.com/Vampsecure-Labs/vamp-http-audit
8
+ Project-URL: Repository, https://github.com/Vampsecure-Labs/vamp-http-audit
9
+ Keywords: http,security-headers,cors,csp,hsts,audit,pentest,web-security
10
+ Classifier: Development Status :: 5 - Production/Stable
11
+ Classifier: Environment :: Console
12
+ Classifier: Intended Audience :: Information Technology
13
+ Classifier: License :: OSI Approved :: MIT License
14
+ Classifier: Operating System :: OS Independent
15
+ Classifier: Programming Language :: Python :: 3
16
+ Classifier: Topic :: Security
17
+ Classifier: Topic :: Internet :: WWW/HTTP
18
+ Requires-Python: >=3.8
19
+ Description-Content-Type: text/markdown
20
+ Requires-Dist: rich>=13.7.0
21
+
22
+ <h1 align="center">vamp-http-audit</h1>
23
+
24
+ <p align="center">
25
+ <img src="https://img.shields.io/badge/python-3.9%2B-blue?logo=python&logoColor=white" alt="Python 3.9+"/>
26
+ <img src="https://img.shields.io/badge/platform-linux%20%7C%20macOS%20%7C%20windows-lightgrey" alt="Platform"/>
27
+ <img src="https://img.shields.io/badge/license-MIT-green" alt="License MIT"/>
28
+ <img src="https://img.shields.io/badge/VampSecure-Labs-magenta" alt="VampSecure Labs"/>
29
+ </p>
30
+
31
+ ## Overview
32
+
33
+ `vamp-http-audit` is the HTTP layer companion to `vamp-ssl-audit`. Where the TLS auditor covers the transport layer, this tool covers HTTP security headers, CORS misconfigurations, cookie flag analysis, server information disclosure, and open redirect vulnerabilities. It uses the same SSLabs-style A+–F grading system and supports the same output formats (JSON, HTML, Markdown, CSV), making it a natural fit in any automated assessment pipeline.
34
+
35
+ ## Features
36
+
37
+ - SSLabs-style letter grading A+ to F based on combined HTTP security posture
38
+ - Security header analysis: CSP (directive-level deep inspection including `unsafe-inline`, `unsafe-eval`, wildcards, `frame-ancestors`), HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COEP, COOP, CORP
39
+ - CORS misconfiguration probing: attacker-origin reflection, wildcard + credentials (CRITICAL), null-origin acceptance (iframe sandbox bypass)
40
+ - Cookie security analysis: Secure, HttpOnly, SameSite flags; `__Host-` and `__Secure-` prefix enforcement
41
+ - Server information disclosure detection: `Server`, `X-Powered-By`, `X-AspNet-Version`, `X-AspNetMvc-Version`, `X-Generator`, debug headers
42
+ - Open redirect testing across 16 common parameters: `url`, `redirect`, `next`, `return`, `goto`, `destination`, `redir`, `target`, `link`, `forward`, `location`, `rurl`, `returl`, `redirect_uri`, `redirect_url`, `return_url`
43
+ - GraphQL endpoint detection and introspection availability check
44
+ - Concurrent multi-URL scanning with configurable worker pool (`--workers`, default 5)
45
+ - Zero third-party dependencies — only Python stdlib (`urllib`) and `rich`
46
+ - Export to Console, JSON, HTML (dark-theme with collapsible remediations), Markdown, and CSV
47
+
48
+ ## Requirements
49
+
50
+ - Python 3.9 or later
51
+ - `rich >= 13.7.0`
52
+
53
+ ## Installation
54
+
55
+ ```bash
56
+ git clone https://github.com/belky-me/vamp-http-audit.git
57
+ cd vamp-http-audit
58
+ python3 -m venv .venv
59
+ source .venv/bin/activate # Windows: .venv\Scripts\activate
60
+ pip install -r requirements.txt
61
+ ```
62
+
63
+ ## Usage
64
+
65
+ ```
66
+ python3 vamp_http_audit.py --help
67
+ ```
68
+
69
+ ```
70
+ usage: vamp_http_audit.py [-h] [-u URL] [--file FILE]
71
+ [--timeout TIMEOUT] [--workers WORKERS]
72
+ [--json FILE] [--html FILE]
73
+ [--markdown FILE] [--csv FILE]
74
+ [--no-verify-ssl]
75
+ [--client CLIENT] [--engagement ENGAGEMENT]
76
+ [--auditor AUDITOR] [--report-scope SCOPE]
77
+ [--report-html FILE] [--report-pdf FILE]
78
+
79
+ vamp-http-audit — HTTP Security Headers & CORS Auditor (VampSecure Labs)
80
+ ```
81
+
82
+ ## Examples
83
+
84
+ ```bash
85
+ # Audit a single URL
86
+ python3 vamp_http_audit.py -u https://example.com
87
+
88
+ # Audit multiple URLs in one command
89
+ python3 vamp_http_audit.py -u https://example.com -u https://api.example.com
90
+
91
+ # Audit a list of URLs from file with 10 parallel workers
92
+ python3 vamp_http_audit.py --file urls.txt --workers 10
93
+
94
+ # Export results to all formats
95
+ python3 vamp_http_audit.py -u https://example.com \
96
+ --json results.json --html report.html --markdown report.md --csv report.csv
97
+
98
+ # Skip TLS verification for self-signed certificates
99
+ python3 vamp_http_audit.py -u https://internal.staging.local --no-verify-ssl
100
+
101
+ # Generate client-ready engagement report
102
+ python3 vamp_http_audit.py --file urls.txt \
103
+ --client "Acme Corp" --engagement "HTTP Headers Review Q3 2026" \
104
+ --auditor "J. Smith" --report-html client_report.html
105
+ ```
106
+
107
+ ## CLI Reference
108
+
109
+ | Flag | Default | Description |
110
+ |------|---------|-------------|
111
+ | `-u / --url URL` | — | Target URL (repeatable for multiple targets) |
112
+ | `--file FILE` | — | Text file with one URL per line |
113
+ | `--timeout N` | 10 | Per-request timeout in seconds |
114
+ | `--workers N` | 5 | Concurrent worker threads |
115
+ | `--json FILE` | — | Export results to JSON |
116
+ | `--html FILE` | — | Export dark-theme HTML report |
117
+ | `--markdown FILE` | — | Export Markdown report |
118
+ | `--csv FILE` | — | Export CSV summary (+ `FILE.findings` detail file) |
119
+ | `--no-verify-ssl` | off | Disable TLS certificate verification |
120
+ | `--client TEXT` | — | Client name for VSL engagement report |
121
+ | `--engagement TEXT` | — | Engagement title for VSL engagement report |
122
+ | `--auditor TEXT` | — | Auditor name for VSL engagement report |
123
+ | `--report-scope TEXT` | — | Scope description for VSL engagement report |
124
+ | `--report-html FILE` | — | Export unified VSL client report (HTML) |
125
+ | `--report-pdf FILE` | — | Export unified VSL client report (PDF, requires fpdf2) |
126
+
127
+ ## Output Formats
128
+
129
+ | Format | Flag | Description |
130
+ |--------|------|-------------|
131
+ | Console | (default) | Rich-colored graded output with per-finding remediation panels |
132
+ | JSON | `--json FILE` | Machine-readable full result set |
133
+ | HTML | `--html FILE` | Dark-theme standalone report with collapsible remediations |
134
+ | Markdown | `--markdown FILE` | Portable report for inclusion in audit repositories |
135
+ | CSV | `--csv FILE` | Summary row per host + `FILE.findings` with one row per finding |
136
+ | Client HTML | `--report-html FILE` | Unified VampSecure Labs engagement report |
137
+ | Client PDF | `--report-pdf FILE` | PDF version of the VSL client report |
138
+
139
+ ## Grading Scale
140
+
141
+ | Grade | Criteria |
142
+ |-------|----------|
143
+ | A+ | All headers present, solid CSP, secure cookies, no CORS issues |
144
+ | A | Good configuration; missing COOP/COEP/CORP or SameSite on some cookies |
145
+ | A- | CSP with `unsafe-inline`/`eval`/wildcard; suboptimal Referrer-Policy |
146
+ | B | CSP absent · X-Content-Type-Options absent · server version exposed · insecure cookie · CORS wildcard without credentials |
147
+ | C | X-Frame-Options absent without `frame-ancestors` · HSTS absent |
148
+ | F | CORS wildcard + credentials · confirmed open redirect |
149
+
150
+ ## Exit Codes
151
+
152
+ | Code | Meaning | CI/CD Behavior |
153
+ |------|---------|----------------|
154
+ | `0` | No critical or high findings | Pipeline passes |
155
+ | `1` | High-severity findings detected | Pipeline fails — review required |
156
+ | `2` | Critical-severity findings detected | Pipeline fails — immediate action required |
157
+
158
+ ## Legal Notice
159
+
160
+ Use exclusively on systems you own or for which you hold explicit written authorization from the system owner. VampSecure Studios assumes no liability for unauthorized use.
161
+
162
+ ## Part of VampSecure Labs Toolkit
163
+
164
+ `vamp-http-audit` is one tool in the VampSecure Labs security research toolkit. For the full toolkit including the orchestrator that runs all tools in sequence and aggregates findings into a single engagement report, see:
165
+
166
+ - Portfolio: [github.com/belky-me](https://github.com/belky-me)
167
+ - Orchestrator: [github.com/belky-me/vamp-orchestrator](https://github.com/belky-me/vamp-orchestrator)
168
+
169
+ ---
170
+
171
+ © VampSecure Studios — VampSecure Labs Security Research Division
vamp_http_audit-1.0.0/README.md ADDED
@@ -0,0 +1,150 @@
1
+ <h1 align="center">vamp-http-audit</h1>
2
+
3
+ <p align="center">
4
+ <img src="https://img.shields.io/badge/python-3.9%2B-blue?logo=python&logoColor=white" alt="Python 3.9+"/>
5
+ <img src="https://img.shields.io/badge/platform-linux%20%7C%20macOS%20%7C%20windows-lightgrey" alt="Platform"/>
6
+ <img src="https://img.shields.io/badge/license-MIT-green" alt="License MIT"/>
7
+ <img src="https://img.shields.io/badge/VampSecure-Labs-magenta" alt="VampSecure Labs"/>
8
+ </p>
9
+
10
+ ## Overview
11
+
12
+ `vamp-http-audit` is the HTTP layer companion to `vamp-ssl-audit`. Where the TLS auditor covers the transport layer, this tool covers HTTP security headers, CORS misconfigurations, cookie flag analysis, server information disclosure, and open redirect vulnerabilities. It uses the same SSLabs-style A+–F grading system and supports the same output formats (JSON, HTML, Markdown, CSV), making it a natural fit in any automated assessment pipeline.
13
+
14
+ ## Features
15
+
16
+ - SSLabs-style letter grading A+ to F based on combined HTTP security posture
17
+ - Security header analysis: CSP (directive-level deep inspection including `unsafe-inline`, `unsafe-eval`, wildcards, `frame-ancestors`), HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COEP, COOP, CORP
18
+ - CORS misconfiguration probing: attacker-origin reflection, wildcard + credentials (CRITICAL), null-origin acceptance (iframe sandbox bypass)
19
+ - Cookie security analysis: Secure, HttpOnly, SameSite flags; `__Host-` and `__Secure-` prefix enforcement
20
+ - Server information disclosure detection: `Server`, `X-Powered-By`, `X-AspNet-Version`, `X-AspNetMvc-Version`, `X-Generator`, debug headers
21
+ - Open redirect testing across 16 common parameters: `url`, `redirect`, `next`, `return`, `goto`, `destination`, `redir`, `target`, `link`, `forward`, `location`, `rurl`, `returl`, `redirect_uri`, `redirect_url`, `return_url`
22
+ - GraphQL endpoint detection and introspection availability check
23
+ - Concurrent multi-URL scanning with configurable worker pool (`--workers`, default 5)
24
+ - Zero third-party dependencies — only Python stdlib (`urllib`) and `rich`
25
+ - Export to Console, JSON, HTML (dark-theme with collapsible remediations), Markdown, and CSV
26
+
27
+ ## Requirements
28
+
29
+ - Python 3.9 or later
30
+ - `rich >= 13.7.0`
31
+
32
+ ## Installation
33
+
34
+ ```bash
35
+ git clone https://github.com/belky-me/vamp-http-audit.git
36
+ cd vamp-http-audit
37
+ python3 -m venv .venv
38
+ source .venv/bin/activate # Windows: .venv\Scripts\activate
39
+ pip install -r requirements.txt
40
+ ```
41
+
42
+ ## Usage
43
+
44
+ ```
45
+ python3 vamp_http_audit.py --help
46
+ ```
47
+
48
+ ```
49
+ usage: vamp_http_audit.py [-h] [-u URL] [--file FILE]
50
+ [--timeout TIMEOUT] [--workers WORKERS]
51
+ [--json FILE] [--html FILE]
52
+ [--markdown FILE] [--csv FILE]
53
+ [--no-verify-ssl]
54
+ [--client CLIENT] [--engagement ENGAGEMENT]
55
+ [--auditor AUDITOR] [--report-scope SCOPE]
56
+ [--report-html FILE] [--report-pdf FILE]
57
+
58
+ vamp-http-audit — HTTP Security Headers & CORS Auditor (VampSecure Labs)
59
+ ```
60
+
61
+ ## Examples
62
+
63
+ ```bash
64
+ # Audit a single URL
65
+ python3 vamp_http_audit.py -u https://example.com
66
+
67
+ # Audit multiple URLs in one command
68
+ python3 vamp_http_audit.py -u https://example.com -u https://api.example.com
69
+
70
+ # Audit a list of URLs from file with 10 parallel workers
71
+ python3 vamp_http_audit.py --file urls.txt --workers 10
72
+
73
+ # Export results to all formats
74
+ python3 vamp_http_audit.py -u https://example.com \
75
+ --json results.json --html report.html --markdown report.md --csv report.csv
76
+
77
+ # Skip TLS verification for self-signed certificates
78
+ python3 vamp_http_audit.py -u https://internal.staging.local --no-verify-ssl
79
+
80
+ # Generate client-ready engagement report
81
+ python3 vamp_http_audit.py --file urls.txt \
82
+ --client "Acme Corp" --engagement "HTTP Headers Review Q3 2026" \
83
+ --auditor "J. Smith" --report-html client_report.html
84
+ ```
85
+
86
+ ## CLI Reference
87
+
88
+ | Flag | Default | Description |
89
+ |------|---------|-------------|
90
+ | `-u / --url URL` | — | Target URL (repeatable for multiple targets) |
91
+ | `--file FILE` | — | Text file with one URL per line |
92
+ | `--timeout N` | 10 | Per-request timeout in seconds |
93
+ | `--workers N` | 5 | Concurrent worker threads |
94
+ | `--json FILE` | — | Export results to JSON |
95
+ | `--html FILE` | — | Export dark-theme HTML report |
96
+ | `--markdown FILE` | — | Export Markdown report |
97
+ | `--csv FILE` | — | Export CSV summary (+ `FILE.findings` detail file) |
98
+ | `--no-verify-ssl` | off | Disable TLS certificate verification |
99
+ | `--client TEXT` | — | Client name for VSL engagement report |
100
+ | `--engagement TEXT` | — | Engagement title for VSL engagement report |
101
+ | `--auditor TEXT` | — | Auditor name for VSL engagement report |
102
+ | `--report-scope TEXT` | — | Scope description for VSL engagement report |
103
+ | `--report-html FILE` | — | Export unified VSL client report (HTML) |
104
+ | `--report-pdf FILE` | — | Export unified VSL client report (PDF, requires fpdf2) |
105
+
106
+ ## Output Formats
107
+
108
+ | Format | Flag | Description |
109
+ |--------|------|-------------|
110
+ | Console | (default) | Rich-colored graded output with per-finding remediation panels |
111
+ | JSON | `--json FILE` | Machine-readable full result set |
112
+ | HTML | `--html FILE` | Dark-theme standalone report with collapsible remediations |
113
+ | Markdown | `--markdown FILE` | Portable report for inclusion in audit repositories |
114
+ | CSV | `--csv FILE` | Summary row per host + `FILE.findings` with one row per finding |
115
+ | Client HTML | `--report-html FILE` | Unified VampSecure Labs engagement report |
116
+ | Client PDF | `--report-pdf FILE` | PDF version of the VSL client report |
117
+
118
+ ## Grading Scale
119
+
120
+ | Grade | Criteria |
121
+ |-------|----------|
122
+ | A+ | All headers present, solid CSP, secure cookies, no CORS issues |
123
+ | A | Good configuration; missing COOP/COEP/CORP or SameSite on some cookies |
124
+ | A- | CSP with `unsafe-inline`/`eval`/wildcard; suboptimal Referrer-Policy |
125
+ | B | CSP absent · X-Content-Type-Options absent · server version exposed · insecure cookie · CORS wildcard without credentials |
126
+ | C | X-Frame-Options absent without `frame-ancestors` · HSTS absent |
127
+ | F | CORS wildcard + credentials · confirmed open redirect |
128
+
129
+ ## Exit Codes
130
+
131
+ | Code | Meaning | CI/CD Behavior |
132
+ |------|---------|----------------|
133
+ | `0` | No critical or high findings | Pipeline passes |
134
+ | `1` | High-severity findings detected | Pipeline fails — review required |
135
+ | `2` | Critical-severity findings detected | Pipeline fails — immediate action required |
136
+
137
+ ## Legal Notice
138
+
139
+ Use exclusively on systems you own or for which you hold explicit written authorization from the system owner. VampSecure Studios assumes no liability for unauthorized use.
140
+
141
+ ## Part of VampSecure Labs Toolkit
142
+
143
+ `vamp-http-audit` is one tool in the VampSecure Labs security research toolkit. For the full toolkit including the orchestrator that runs all tools in sequence and aggregates findings into a single engagement report, see:
144
+
145
+ - Portfolio: [github.com/belky-me](https://github.com/belky-me)
146
+ - Orchestrator: [github.com/belky-me/vamp-orchestrator](https://github.com/belky-me/vamp-orchestrator)
147
+
148
+ ---
149
+
150
+ © VampSecure Studios — VampSecure Labs Security Research Division
vamp_http_audit-1.0.0/pyproject.toml ADDED
@@ -0,0 +1,34 @@
1
+ [build-system]
2
+ requires = ["setuptools>=68", "wheel"]
3
+ build-backend = "setuptools.build_meta"
4
+
5
+ [project]
6
+ name = "vamp-http-audit"
7
+ version = "1.0.0"
8
+ description = "HTTP security headers and CORS auditor — CSP, HSTS, X-Frame-Options, Referrer-Policy, Permissions-Policy"
9
+ readme = "README.md"
10
+ license = { text = "MIT" }
11
+ requires-python = ">=3.8"
12
+ authors = [{ name = "VampSecure Studios", email = "contact@vampsecurestudios.com" }]
13
+ keywords = ["http", "security-headers", "cors", "csp", "hsts", "audit", "pentest", "web-security"]
14
+ classifiers = [
15
+ "Development Status :: 5 - Production/Stable",
16
+ "Environment :: Console",
17
+ "Intended Audience :: Information Technology",
18
+ "License :: OSI Approved :: MIT License",
19
+ "Operating System :: OS Independent",
20
+ "Programming Language :: Python :: 3",
21
+ "Topic :: Security",
22
+ "Topic :: Internet :: WWW/HTTP",
23
+ ]
24
+ dependencies = ["rich>=13.7.0"]
25
+
26
+ [project.scripts]
27
+ vamp-http-audit = "vamp_http_audit:main"
28
+
29
+ [project.urls]
30
+ Homepage = "https://github.com/Vampsecure-Labs/vamp-http-audit"
31
+ Repository = "https://github.com/Vampsecure-Labs/vamp-http-audit"
32
+
33
+ [tool.setuptools]
34
+ py-modules = ["vamp_http_audit", "vampsec_report"]
vamp_http_audit-1.0.0/setup.cfg ADDED
@@ -0,0 +1,4 @@
1
+ [egg_info]
2
+ tag_build =
3
+ tag_date = 0
4
+
vamp_http_audit-1.0.0/vamp_http_audit.egg-info/PKG-INFO ADDED
@@ -0,0 +1,171 @@
1
+ Metadata-Version: 2.4
2
+ Name: vamp-http-audit
3
+ Version: 1.0.0
4
+ Summary: HTTP security headers and CORS auditor — CSP, HSTS, X-Frame-Options, Referrer-Policy, Permissions-Policy
5
+ Author-email: VampSecure Studios <contact@vampsecurestudios.com>
6
+ License: MIT
7
+ Project-URL: Homepage, https://github.com/Vampsecure-Labs/vamp-http-audit
8
+ Project-URL: Repository, https://github.com/Vampsecure-Labs/vamp-http-audit
9
+ Keywords: http,security-headers,cors,csp,hsts,audit,pentest,web-security
10
+ Classifier: Development Status :: 5 - Production/Stable
11
+ Classifier: Environment :: Console
12
+ Classifier: Intended Audience :: Information Technology
13
+ Classifier: License :: OSI Approved :: MIT License
14
+ Classifier: Operating System :: OS Independent
15
+ Classifier: Programming Language :: Python :: 3
16
+ Classifier: Topic :: Security
17
+ Classifier: Topic :: Internet :: WWW/HTTP
18
+ Requires-Python: >=3.8
19
+ Description-Content-Type: text/markdown
20
+ Requires-Dist: rich>=13.7.0
21
+
22
+ <h1 align="center">vamp-http-audit</h1>
23
+
24
+ <p align="center">
25
+ <img src="https://img.shields.io/badge/python-3.9%2B-blue?logo=python&logoColor=white" alt="Python 3.9+"/>
26
+ <img src="https://img.shields.io/badge/platform-linux%20%7C%20macOS%20%7C%20windows-lightgrey" alt="Platform"/>
27
+ <img src="https://img.shields.io/badge/license-MIT-green" alt="License MIT"/>
28
+ <img src="https://img.shields.io/badge/VampSecure-Labs-magenta" alt="VampSecure Labs"/>
29
+ </p>
30
+
31
+ ## Overview
32
+
33
+ `vamp-http-audit` is the HTTP layer companion to `vamp-ssl-audit`. Where the TLS auditor covers the transport layer, this tool covers HTTP security headers, CORS misconfigurations, cookie flag analysis, server information disclosure, and open redirect vulnerabilities. It uses the same SSLabs-style A+–F grading system and supports the same output formats (JSON, HTML, Markdown, CSV), making it a natural fit in any automated assessment pipeline.
34
+
35
+ ## Features
36
+
37
+ - SSLabs-style letter grading A+ to F based on combined HTTP security posture
38
+ - Security header analysis: CSP (directive-level deep inspection including `unsafe-inline`, `unsafe-eval`, wildcards, `frame-ancestors`), HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COEP, COOP, CORP
39
+ - CORS misconfiguration probing: attacker-origin reflection, wildcard + credentials (CRITICAL), null-origin acceptance (iframe sandbox bypass)
40
+ - Cookie security analysis: Secure, HttpOnly, SameSite flags; `__Host-` and `__Secure-` prefix enforcement
41
+ - Server information disclosure detection: `Server`, `X-Powered-By`, `X-AspNet-Version`, `X-AspNetMvc-Version`, `X-Generator`, debug headers
42
+ - Open redirect testing across 16 common parameters: `url`, `redirect`, `next`, `return`, `goto`, `destination`, `redir`, `target`, `link`, `forward`, `location`, `rurl`, `returl`, `redirect_uri`, `redirect_url`, `return_url`
43
+ - GraphQL endpoint detection and introspection availability check
44
+ - Concurrent multi-URL scanning with configurable worker pool (`--workers`, default 5)
45
+ - Zero third-party dependencies — only Python stdlib (`urllib`) and `rich`
46
+ - Export to Console, JSON, HTML (dark-theme with collapsible remediations), Markdown, and CSV
47
+
48
+ ## Requirements
49
+
50
+ - Python 3.9 or later
51
+ - `rich >= 13.7.0`
52
+
53
+ ## Installation
54
+
55
+ ```bash
56
+ git clone https://github.com/belky-me/vamp-http-audit.git
57
+ cd vamp-http-audit
58
+ python3 -m venv .venv
59
+ source .venv/bin/activate # Windows: .venv\Scripts\activate
60
+ pip install -r requirements.txt
61
+ ```
62
+
63
+ ## Usage
64
+
65
+ ```
66
+ python3 vamp_http_audit.py --help
67
+ ```
68
+
69
+ ```
70
+ usage: vamp_http_audit.py [-h] [-u URL] [--file FILE]
71
+ [--timeout TIMEOUT] [--workers WORKERS]
72
+ [--json FILE] [--html FILE]
73
+ [--markdown FILE] [--csv FILE]
74
+ [--no-verify-ssl]
75
+ [--client CLIENT] [--engagement ENGAGEMENT]
76
+ [--auditor AUDITOR] [--report-scope SCOPE]
77
+ [--report-html FILE] [--report-pdf FILE]
78
+
79
+ vamp-http-audit — HTTP Security Headers & CORS Auditor (VampSecure Labs)
80
+ ```
81
+
82
+ ## Examples
83
+
84
+ ```bash
85
+ # Audit a single URL
86
+ python3 vamp_http_audit.py -u https://example.com
87
+
88
+ # Audit multiple URLs in one command
89
+ python3 vamp_http_audit.py -u https://example.com -u https://api.example.com
90
+
91
+ # Audit a list of URLs from file with 10 parallel workers
92
+ python3 vamp_http_audit.py --file urls.txt --workers 10
93
+
94
+ # Export results to all formats
95
+ python3 vamp_http_audit.py -u https://example.com \
96
+ --json results.json --html report.html --markdown report.md --csv report.csv
97
+
98
+ # Skip TLS verification for self-signed certificates
99
+ python3 vamp_http_audit.py -u https://internal.staging.local --no-verify-ssl
100
+
101
+ # Generate client-ready engagement report
102
+ python3 vamp_http_audit.py --file urls.txt \
103
+ --client "Acme Corp" --engagement "HTTP Headers Review Q3 2026" \
104
+ --auditor "J. Smith" --report-html client_report.html
105
+ ```
106
+
107
+ ## CLI Reference
108
+
109
+ | Flag | Default | Description |
110
+ |------|---------|-------------|
111
+ | `-u / --url URL` | — | Target URL (repeatable for multiple targets) |
112
+ | `--file FILE` | — | Text file with one URL per line |
113
+ | `--timeout N` | 10 | Per-request timeout in seconds |
114
+ | `--workers N` | 5 | Concurrent worker threads |
115
+ | `--json FILE` | — | Export results to JSON |
116
+ | `--html FILE` | — | Export dark-theme HTML report |
117
+ | `--markdown FILE` | — | Export Markdown report |
118
+ | `--csv FILE` | — | Export CSV summary (+ `FILE.findings` detail file) |
119
+ | `--no-verify-ssl` | off | Disable TLS certificate verification |
120
+ | `--client TEXT` | — | Client name for VSL engagement report |
121
+ | `--engagement TEXT` | — | Engagement title for VSL engagement report |
122
+ | `--auditor TEXT` | — | Auditor name for VSL engagement report |
123
+ | `--report-scope TEXT` | — | Scope description for VSL engagement report |
124
+ | `--report-html FILE` | — | Export unified VSL client report (HTML) |
125
+ | `--report-pdf FILE` | — | Export unified VSL client report (PDF, requires fpdf2) |
126
+
127
+ ## Output Formats
128
+
129
+ | Format | Flag | Description |
130
+ |--------|------|-------------|
131
+ | Console | (default) | Rich-colored graded output with per-finding remediation panels |
132
+ | JSON | `--json FILE` | Machine-readable full result set |
133
+ | HTML | `--html FILE` | Dark-theme standalone report with collapsible remediations |
134
+ | Markdown | `--markdown FILE` | Portable report for inclusion in audit repositories |
135
+ | CSV | `--csv FILE` | Summary row per host + `FILE.findings` with one row per finding |
136
+ | Client HTML | `--report-html FILE` | Unified VampSecure Labs engagement report |
137
+ | Client PDF | `--report-pdf FILE` | PDF version of the VSL client report |
138
+
139
+ ## Grading Scale
140
+
141
+ | Grade | Criteria |
142
+ |-------|----------|
143
+ | A+ | All headers present, solid CSP, secure cookies, no CORS issues |
144
+ | A | Good configuration; missing COOP/COEP/CORP or SameSite on some cookies |
145
+ | A- | CSP with `unsafe-inline`/`eval`/wildcard; suboptimal Referrer-Policy |
146
+ | B | CSP absent · X-Content-Type-Options absent · server version exposed · insecure cookie · CORS wildcard without credentials |
147
+ | C | X-Frame-Options absent without `frame-ancestors` · HSTS absent |
148
+ | F | CORS wildcard + credentials · confirmed open redirect |
149
+
150
+ ## Exit Codes
151
+
152
+ | Code | Meaning | CI/CD Behavior |
153
+ |------|---------|----------------|
154
+ | `0` | No critical or high findings | Pipeline passes |
155
+ | `1` | High-severity findings detected | Pipeline fails — review required |
156
+ | `2` | Critical-severity findings detected | Pipeline fails — immediate action required |
157
+
158
+ ## Legal Notice
159
+
160
+ Use exclusively on systems you own or for which you hold explicit written authorization from the system owner. VampSecure Studios assumes no liability for unauthorized use.
161
+
162
+ ## Part of VampSecure Labs Toolkit
163
+
164
+ `vamp-http-audit` is one tool in the VampSecure Labs security research toolkit. For the full toolkit including the orchestrator that runs all tools in sequence and aggregates findings into a single engagement report, see:
165
+
166
+ - Portfolio: [github.com/belky-me](https://github.com/belky-me)
167
+ - Orchestrator: [github.com/belky-me/vamp-orchestrator](https://github.com/belky-me/vamp-orchestrator)
168
+
169
+ ---
170
+
171
+ © VampSecure Studios — VampSecure Labs Security Research Division
vamp_http_audit-1.0.0/vamp_http_audit.egg-info/SOURCES.txt ADDED
@@ -0,0 +1,10 @@
1
+ README.md
2
+ pyproject.toml
3
+ vamp_http_audit.py
4
+ vampsec_report.py
5
+ vamp_http_audit.egg-info/PKG-INFO
6
+ vamp_http_audit.egg-info/SOURCES.txt
7
+ vamp_http_audit.egg-info/dependency_links.txt
8
+ vamp_http_audit.egg-info/entry_points.txt
9
+ vamp_http_audit.egg-info/requires.txt
10
+ vamp_http_audit.egg-info/top_level.txt
vamp_http_audit-1.0.0/vamp_http_audit.egg-info/entry_points.txt ADDED
@@ -0,0 +1,2 @@
1
+ [console_scripts]
2
+ vamp-http-audit = vamp_http_audit:main
vamp_http_audit-1.0.0/vamp_http_audit.egg-info/requires.txt ADDED
@@ -0,0 +1 @@
1
+ rich>=13.7.0
vamp_http_audit-1.0.0/vamp_http_audit.egg-info/top_level.txt ADDED
@@ -0,0 +1,2 @@
1
+ vamp_http_audit
2
+ vampsec_report