@passmarked/http

    1.0.5 • Public • Published

    @passmarked/http

    NPM Build Status

    Passmarked is a suite of tests that can be run against any page/website to identify issues with parity to most online tools in one package.

    The Terminal Client is intended for use by developers to integrate into their workflow/CI servers but also integrate into their own application that might need to test websites and provide realtime feedback.

    All of the checks on Passmarked can be voted on importance and are open-sourced, to encourage community involvement in fixing and adding new rules. We are building the living Web Standard and love any contributions.

    Synopsis

    The rules checked in this module are:

    • versioning - The web server included the version in the response headers back to the client, which could lead to attackers easily identifying vulnerabilities in the specific serving version.
    • aspnet - The ASP.NET version was returned by the server, this allows attackers to both see that ASP.NET is being used and find vulnerabilities specific to that version.
    • aspnetmvc - The ASP.NET MVC version was returned by the server, this allows attackers to both see that ASP.NET MVC is being used and find vulnerabilities specific to that version.
    • contenttype.missing - The x-content-type-options header was not returned by the server in the document request
    • contenttype.incorrect - The x-content-type-options header was returned but expected at least "nosniff" to be present.
    • frameoptions.missing - The x-frame-options header was not defined.
    • frameoptions.incorrect - The x-frame-options header was not a expected option, one of the following are expected: DENY, SAMEORIGIN or ALLOW-FROM.
    • poweredby - The x-powered-by header was returned, which would allow attackers looking at the headers to easily see which technology/framework to target.
    • xss.missing - The x-xss-protection header was not defined.
    • xss.incorrect - The x-xss-protection header was defined but was expecting the following format 1; mode=block

    Running

    The rules are checked everytime a url is run through Passmarked or our API. To run using the hosted system head to passmarked.com or our Terminal Client use:

    npm install -g passmarked
    passmarked --filter=http example.com

    The hosted version allows free runs from our homepage and the option to register a site to check in its entirety. Using the Passmarked npm module (or directly via the API) integrations are also possible to get running reports with all the rules in a matter of seconds.

    Running Locally

    All rules can be run locally using our main integration library. This requires installing the package and any dependencies that the code might have such as a specific version of OpenSSL, see #dependencies

    First ensure passmarked is installed:

    npm install passmarked
    npm install @passmarked/http

    After which the rules will be runnable using promises:

    passmarked.createRunner(
      require('@passmarked/http'), // this package
      require('@passmarked/ssl') // to test SSL
    ).run({
      url: 'http://example.com',
      body: 'body of page here',
      har: {log: {entries: []}}
    }).then(function(payload) {
      if (payload.hasRule('secure')) {
        console.log('better check that ...');
      }
      var rules = payload.getRules();
      for (var rule in rules) {
        console.log('*', rules[rule].getMessage());
      }
    }).catch(console.error.bind(console));

    Alternatively, callbacks are also available:

    passmarked.createRunner(
      require('@passmarked/http'),
      require('@passmarked/ssl'),
      require('@passmarked/inspect')
    ).run({
      url: 'http://example.com',
      body: 'body of page here',
      har: {log: {entries: []}}
    }, function(err, payload) {
      if (payload.hasRule('secure')) {
        console.log("better check that ...");
      }
      var rules = payload.getRules();
      for (var rule in rules) {
        console.log('*', rules[rule].getMessage());
      }
    });

    Dependencies

    This module does not need any specific external services or packages. This section will be updated if that ever changes with detailed setup steps/links.

    Rules

    Rules represent checks that occur in this module, all of these rules have a UID which can be used to check for specific rules. For the structure and more details see the Wiki page on Rules.

    Rules also include a type which could be critical, error, warning or notice giving a better view on the importance of the rule.

    Contributing

    git clone git@github.com:passmarked/http.git
    npm install
    npm test

    Pull requests have a prerequisite of passing tests. If your contribution is accepted, it will be merged into develop (and then master after staging tests by the team) which will then be deployed live to passmarked.com and on NPM for everyone to download and test.

    About

    To learn more visit:

    License

    Copyright 2016 Passmarked Inc

    Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0
    

    Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

    Install

    npm i @passmarked/http

    DownloadsWeekly Downloads

    1

    Version

    1.0.5

    License

    Apache-2.0

    Last publish

    Collaborators

    • passmarked