Skip to content

Latest commit

 

History

History
150 lines (95 loc) · 4.96 KB

README.md

File metadata and controls

150 lines (95 loc) · 4.96 KB
Raw

dotnet http-security-check

A .NET Core global tool to do a http request/response security assessment. You can also find some information on my Blog.

Installation

Download and install the .NET Core 2.2 SDK or newer. Once installed, run the following command:

dotnet tool install -g DotnetHttpSecurityCheck

If you already have a previous version of DotnetHttpSecurityCheck installed, you can upgrade to the latest version using the following command:

dotnet tool update -g DotnetHttpSecurityCheck

Usage

1.0.0

A dotnet tool to do a http request/response security assessment.

Usage: http-security-check [arguments] [options]

Arguments:
  Url                   A absolute URL for the security assessment (required).

Options:
  --version             Show version information
  -?|-h|--help          Show help information
  -o|--output <value>   The report output file path (optional).
  -f|--format <value>   Format of the report (optional). Default is Text.
  -v|--verbose <value>  Set the console verbosity level (optional). Default is normal. Allowed values are n[normal], q[uiet], d[etailed].

All Security Checks:

  > Header

    1# X-Content-Type-Options: Checks the response header value of the 'X-Content-Type-Options' header.
       Recommended is "X-Content-Type-Options: nosniff".

    2# X-Frame-Options: Checks the response header value of the 'X-Frame-Options' header.
       Recommended is "X-Frame-Options: deny".

    3# X-XSS-Protection: Checks the response header value of the 'X-XSS-Protection' header.
       Recommended is "X-XSS-Protection: 1;".

    4# Referrer-Policy: Checks the response header value of the 'Referrer-Policy' header.
       Recommended values: "strict-origin", "strict-origin-when-cross-origin" or "no-referrer".

    5# Content-Security-Policy: Checks the response header value of the 'Content-Security-Policy' header.
       Whitelisting sources of approved content. Example: "Content-Security-Policy: default-src 'self'"

    6# Strict-Transport-Security: Checks the response header value of the 'Strict-Transport-Security' header.
       Recommended is "Strict-Transport-Security: max-age=31536000; includeSubDomains".

    7# X-Powered-By: Checks the response header value of the 'X-Powered-By' header.
       Technology information should be removed.

    8# Server: Checks the response header value of the 'Server' header.
       Server information should be removed.

  > Request

    1# Server Certificate: Checks for server certificate validation errors.
       Recommended is a valid certificate that has no errors.

    2# HTTPS: Checks that the request/response is HTTPS.
       Recommended is to use HTTPS.

Usage examples

Simplest usage:

dotnet http-security-check https://example.com

Same as above, but writes a textual report:

dotnet http-security-check https://example.com -o=.\Report.txt

The tool has basic support for reporting. By default the report is written to the console.

Contribution

Feel free to create issues and PR's (pull requests) to improve this tool - any help is appreciated! The project is splitted in three projects:

Core

CodeTherapy.HttpSecurityCheck.csproj is the core library with all the security checks and infrastructure.

Tool

DotnetHttpSecurityCheck.csproj is the dotnet tool console command - a lightweight wrapper around the core.

Tests

CodeTherapy.HttpSecurityCheck.Tests.csproj contains unit tests and integration tests.

Code Coverage (powered by Coverlet)

Module Line Branch Method
CodeTherapy.HttpSecurityCheck 85.2% 78.4% 83.3%

Build, Test & Pack

The project separates the three concerns Building, Testing and Packaging. All of these steps could be executed individually.

BuildTestPack.ps1

This command calls internally Build.ps1, Test.ps1 and Pack.ps1 and supports following parameters:

Parameter Description Type
Configuration Can be set to "Release" or "Debug" string
CollectCoverage When set, code coverage is calculated switch
NoIntegrationTests When set, integration tests are skipped switch
Pack When set, nuget packages are created (call to Pack.ps1) switch

Build.ps1

Builds all projects. Supports the Configuration parameter.

Test.ps1

Runs all tests. Supports Configuration, CollectCoverage, NoIntegrationTests and NoBuild parameters.

Parameter Description Type
NoBuild The projects are not re-build switch

Pack.ps1

Creates the nuget packages into the .\artifacts directory. Supports Configuration and NoBuild parameters.

License

This project is licensed under the MIT License - see the LICENSE.md file for details.