check_headers.sh

#!/usr/bin/env bash

set -uo pipefail
 
# ---- Config ----------------------------------------------------------
HEADERS=(
  "Strict-Transport-Security"
  "X-Frame-Options"
  "X-Content-Type-Options"
  "Referrer-Policy"
  "Content-Security-Policy"
  "Permissions-Policy"
)
TIMEOUT=10
OUTFILE="header_check_report_$(date +%Y%m%d_%H%M%S).txt"
 
# Directives that matter for script/object execution control.
# CSP is weak mainly when THESE allow unsafe sources, or are missing
# and fall back to a permissive default-src.
CSP_SENSITIVE_DIRECTIVES=("script-src" "object-src" "base-uri" "frame-ancestors" "default-src" "style-src" "form-action")
 
# ---- Colors (fallback to plain if not a tty) --------------------------
if [ -t 1 ]; then
  GREEN="\033[0;32m"; RED="\033[0;31m"; YELLOW="\033[1;33m"; CYAN="\033[0;36m"; NC="\033[0m"
else
  GREEN=""; RED=""; YELLOW=""; CYAN=""; NC=""
fi
 
# ---- CSP analysis --------------------------------------------------------
# Parses a Content-Security-Policy value and prints weaknesses + reasons.
# Logic:
#  - Split into directives (semicolon separated).
#  - For script-src / object-src / base-uri / frame-ancestors: if the
#    directive is absent, check whether default-src covers it; if
#    default-src is also absent or itself weak, flag it.
#  - Check each present sensitive directive's source list for known-weak
#    tokens (unsafe-inline, unsafe-eval, wildcards, bare data:/http:, etc).
analyze_csp() {
  local csp="$1"
  local -A directive_value
  local found_weak=0
 
  # Normalize and split on ';'
  local IFS=';'
  local parts=($csp)
  unset IFS
 
  for part in "${parts[@]}"; do
    part=$(echo "$part" | sed -E 's/^[ \t]+|[ \t]+$//g')
    [ -z "$part" ] && continue
    local dname
    dname=$(echo "$part" | awk '{print tolower($1)}')
    directive_value["$dname"]="$part"
  done
 
  # helper: evaluate a directive's source list for weak tokens
  # args: directive-name, full "directive value1 value2..." string
  eval_sources() {
    local dname="$1"
    local val="$2"
    local reasons=()
 
    if echo "$val" | grep -qi "'unsafe-inline'"; then
      reasons+=("allows 'unsafe-inline' -> inline <script>/<style> or on* handlers execute, which is exactly what CSP is meant to block; defeats XSS mitigation almost entirely")
    fi
    if echo "$val" | grep -qi "'unsafe-eval'"; then
      reasons+=("allows 'unsafe-eval' -> eval()/Function()/setTimeout(string) can run attacker-supplied strings as code")
    fi
    if echo "$val" | grep -qi "'unsafe-hashes'"; then
      reasons+=("allows 'unsafe-hashes' -> permits inline event handlers matching a hash, widening the inline-execution surface")
    fi
    if echo "$val" | grep -Eqi "(^| )\*( |$)"; then
      reasons+=("wildcard '*' source -> any domain can host allowed content (script/object/etc.), so an attacker just needs one open host to inject")
    fi
    if echo "$val" | grep -Eqi "https:\*|https:[[:space:]]"; then
      : # scheme-only https: still broad but far less severe; note separately below
    fi
    if echo "$val" | grep -Eqi "(^| )https:( |$)"; then
      reasons+=("bare 'https:' scheme source -> allows content from ANY https domain, not just trusted ones")
    fi
    if echo "$val" | grep -Eqi "(^| )http:( |$)"; then
      reasons+=("bare 'http:' scheme source -> allows loading over plaintext HTTP from any host, enabling MITM injection")
    fi
    if echo "$val" | grep -Eqi "(^| )data:( |$)" && [[ "$dname" == "script-src" || "$dname" == "default-src" || "$dname" == "object-src" ]]; then
      reasons+=("allows 'data:' URIs for scripts/objects -> attacker can smuggle a payload as a data: URI to bypass host allowlisting")
    fi
    if echo "$val" | grep -qi "'none'" && [ "${#reasons[@]}" -gt 0 ]; then
      : # inconsistent but leave as-is; real values won't mix 'none' with sources
    fi
 
    if [ "${#reasons[@]}" -gt 0 ]; then
      found_weak=1
      echo -e "${RED}    - ${dname}${NC}: $(echo "$val" | sed -E "s/^${dname}[ \t]*//")" | tee -a "$OUTFILE"
      for r in "${reasons[@]}"; do
        echo -e "        ${YELLOW}why weak:${NC} $r" | tee -a "$OUTFILE"
      done
    fi
  }
 
  echo -e "${CYAN}  [CSP ANALYSIS]${NC}" | tee -a "$OUTFILE"
 
  for dname in "${CSP_SENSITIVE_DIRECTIVES[@]}"; do
    if [ -n "${directive_value[$dname]:-}" ]; then
      eval_sources "$dname" "${directive_value[$dname]}"
    fi
  done
 
  # Missing-directive checks: only meaningful if there's no safe fallback.
  if [ -z "${directive_value[script-src]:-}" ]; then
    if [ -z "${directive_value[default-src]:-}" ]; then
      found_weak=1
      echo -e "${RED}    - script-src${NC}: MISSING, and no default-src fallback" | tee -a "$OUTFILE"
      echo -e "        ${YELLOW}why weak:${NC} no restriction on where scripts can load from -> equivalent to script-src *" | tee -a "$OUTFILE"
    elif echo "${directive_value[default-src]}" | grep -Eqi "'unsafe-inline'|'unsafe-eval'|(^| )\*( |$)"; then
      found_weak=1
      echo -e "${RED}    - script-src${NC}: MISSING, falls back to a weak default-src" | tee -a "$OUTFILE"
      echo -e "        ${YELLOW}why weak:${NC} script execution is governed by the same permissive default-src listed above" | tee -a "$OUTFILE"
    fi
  fi
 
  if [ -z "${directive_value[object-src]:-}" ] && [ -z "${directive_value[default-src]:-}" ]; then
    found_weak=1
    echo -e "${RED}    - object-src${NC}: MISSING, and no default-src fallback" | tee -a "$OUTFILE"
    echo -e "        ${YELLOW}why weak:${NC} <object>/<embed>/<applet> can load plugins (e.g. Flash) that execute outside normal script restrictions" | tee -a "$OUTFILE"
  fi
 
  if [ -z "${directive_value[base-uri]:-}" ]; then
    found_weak=1
    echo -e "${RED}    - base-uri${NC}: MISSING" | tee -a "$OUTFILE"
    echo -e "        ${YELLOW}why weak:${NC} without it, an injected <base href> tag can hijack all relative script/resource URLs on the page" | tee -a "$OUTFILE"
  fi
 
  if [ -z "${directive_value[frame-ancestors]:-}" ]; then
    found_weak=1
    echo -e "${RED}    - frame-ancestors${NC}: MISSING" | tee -a "$OUTFILE"
    echo -e "        ${YELLOW}why weak:${NC} page can be framed by any site -> clickjacking risk (this is CSP's modern replacement for X-Frame-Options)" | tee -a "$OUTFILE"
  fi
 
  if [ "$found_weak" -eq 0 ]; then
    echo -e "${GREEN}    No weak CSP patterns detected in the checked directives.${NC}" | tee -a "$OUTFILE"
  fi
}
 
# ---- Input check --------------------------------------------------------
if [ $# -lt 1 ]; then
  echo "Usage: $0 <domains_file>"
  exit 1
fi
 
DOMAIN_FILE="$1"
if [ ! -f "$DOMAIN_FILE" ]; then
  echo "Error: file not found: $DOMAIN_FILE"
  exit 1
fi
 
: > "$OUTFILE"
 
echo "Security Header Check Report - $(date)" | tee -a "$OUTFILE"
echo "=========================================" | tee -a "$OUTFILE"
 
# ---- Main loop -----------------------------------------------------------
while IFS= read -r RAW_DOMAIN || [ -n "$RAW_DOMAIN" ]; do
  DOMAIN=$(echo "$RAW_DOMAIN" | sed 's/^[ \t]*//;s/[ \t]*$//')
 
  # skip blanks/comments
  [ -z "$DOMAIN" ] && continue
  [[ "$DOMAIN" == \#* ]] && continue
 
  # add scheme if missing (default https)
  if [[ ! "$DOMAIN" =~ ^https?:// ]]; then
    URL="https://$DOMAIN"
  else
    URL="$DOMAIN"
  fi
 
  echo -e "\n${CYAN}==> Checking: $URL${NC}" | tee -a "$OUTFILE"
 
  # fetch headers only (-I), follow redirects (-L), silent, with timeout
  RESPONSE=$(curl -s -I -L --max-time "$TIMEOUT" "$URL" 2>/tmp/curl_err_$$)
  CURL_EXIT=$?
 
  if [ $CURL_EXIT -ne 0 ] || [ -z "$RESPONSE" ]; then
    echo -e "${RED}  [!] Could not connect (curl exit code: $CURL_EXIT)${NC}" | tee -a "$OUTFILE"
    ERR=$(cat /tmp/curl_err_$$ 2>/dev/null)
    [ -n "$ERR" ] && echo "  curl error: $ERR" | tee -a "$OUTFILE"
    rm -f /tmp/curl_err_$$
    continue
  fi
  rm -f /tmp/curl_err_$$
 
  MISSING=()
 
  for HEADER in "${HEADERS[@]}"; do
    # Case-insensitive header match, grab everything after the colon,
    # take the LAST occurrence (in case of redirects / duplicate headers)
    VALUE=$(echo "$RESPONSE" | grep -i "^${HEADER}:" | tail -1 | sed -E "s/^[^:]+:[ \t]*//" | tr -d '\r')
 
    if [ -n "$VALUE" ]; then
      echo -e "${GREEN}  [FOUND] ${HEADER}${NC}: $VALUE" | tee -a "$OUTFILE"
      if [ "$HEADER" == "Content-Security-Policy" ]; then
        analyze_csp "$VALUE"
      fi
    else
      MISSING+=("$HEADER")
    fi
  done
 
  if [ ${#MISSING[@]} -gt 0 ]; then
    echo -e "${RED}  [MISSING]${NC} ${MISSING[*]}" | tee -a "$OUTFILE"
  else
    echo -e "${YELLOW}  All checked headers present.${NC}" | tee -a "$OUTFILE"
  fi
 
done < "$DOMAIN_FILE"
 
echo -e "\n=========================================" | tee -a "$OUTFILE"
echo "Report saved to: $OUTFILE"