def _get_redirect_header(self): redirectHeader = None httpGetFormat = 'GET {0} HTTP/1.0\r\nHost: {1}\r\n{2}Connection: close\r\n\r\n'.format httpPath = '/' httpAppend = '' try: conn = socket.create_connection((self._ip, 80), self._timeout) except Exception as e: return (-1, 'Error connecting to %s:80 (%s)' % (self._ip, e)) conn.sendall(httpGetFormat(httpPath, self._target[0], httpAppend)) httpResp = parse_http_response(conn) conn.close() if httpResp.version == 9 : # HTTP 0.9 => Probably not an HTTP response return (-1, 'Server did not return an HTTP response') # Check if the server returned a redirection if 300 <= httpResp.status < 400: redirectHeader = httpResp.getheader('Location', None) o = urlparse(redirectHeader) if o.scheme == 'https': return (httpResp.status, redirectHeader) return (httpResp.status, redirectHeader)
def _get_hsts_header(self, target): hstsHeader = None MAX_REDIRECT = 5 nb_redirect = 0 httpGetFormat = "GET {0} HTTP/1.0\r\nHost: {1}\r\n{2}Connection: close\r\n\r\n".format httpPath = "/" httpAppend = "" while nb_redirect < MAX_REDIRECT: sslConn = create_sslyze_connection(target, self._shared_settings) # Perform the SSL handshake sslConn.connect() sslConn.write(httpGetFormat(httpPath, target[0], httpAppend)) httpResp = parse_http_response(sslConn.read(2048)) sslConn.close() if httpResp.version == 9: # HTTP 0.9 => Probably not an HTTP response raise Exception("Server did not return an HTTP response") elif 300 <= httpResp.status < 400: redirectHeader = httpResp.getheader("Location", None) cookieHeader = httpResp.getheader("Set-Cookie", None) if redirectHeader is None: break o = urlparse(redirectHeader) httpPath = o.path # Handle absolute redirection URL if o.hostname: if o.port: port = o.port else: if o.scheme == "https": port = 443 elif o.scheme == "http": # We would have to use urllib for http: URLs raise Exception("Error: server sent a redirection to HTTP.") else: port = target[2] target = (o.hostname, o.hostname, port, target[3]) # Handle cookies if cookieHeader: cookie = Cookie.SimpleCookie(cookieHeader) if cookie: httpAppend = "Cookie:" + cookie.output(attrs=[], header="", sep=";") + "\r\n" nb_redirect += 1 else: hstsHeader = httpResp.getheader("strict-transport-security", None) break return hstsHeader
def _get_hsts_header(self, target): hstsHeader = None HTTP_GET_REQ = 'GET / HTTP/1.0\r\nHost: {0}\r\nConnection: close\r\n\r\n'.format(target[0]) sslConn = create_sslyze_connection(target, self._shared_settings) # Perform the SSL handshake sslConn.connect() sslConn.write(HTTP_GET_REQ) httpResp = parse_http_response(sslConn.read(2048)) sslConn.close() if httpResp.version == 9 : # HTTP 0.9 => Probably not an HTTP response raise Exception('Server did not return an HTTP response') else: hstsHeader = httpResp.getheader('strict-transport-security', None) return hstsHeader
def _get_hsts_header(self, target): hstsHeader = None HTTP_GET_REQ = 'GET / HTTP/1.0\r\nHost: {0}\r\nConnection: close\r\n\r\n'.format( target[0]) sslConn = create_sslyze_connection(target, self._shared_settings) # Perform the SSL handshake sslConn.connect() sslConn.write(HTTP_GET_REQ) httpResp = parse_http_response(sslConn.read(2048)) sslConn.close() if httpResp.version == 9: # HTTP 0.9 => Probably not an HTTP response raise Exception('Server did not return an HTTP response') else: hstsHeader = httpResp.getheader('strict-transport-security', None) return hstsHeader
def _get_hsts_header(self, target): hstsHeader = None MAX_REDIRECT = 5 nb_redirect = 0 httpGetFormat = 'GET {0} HTTP/1.0\r\nHost: {1}\r\n{2}Connection: close\r\n\r\n'.format httpPath = '/' httpAppend = '' while nb_redirect < MAX_REDIRECT: sslConn = create_sslyze_connection(target, self._shared_settings) # Perform the SSL handshake sslConn.connect() sslConn.write(httpGetFormat(httpPath, target[0], httpAppend)) httpResp = parse_http_response(sslConn.read(2048)) sslConn.close() if httpResp.version == 9 : # HTTP 0.9 => Probably not an HTTP response raise Exception('Server did not return an HTTP response') else: hstsHeader = httpResp.getheader('strict-transport-security', None) # If there was no HSTS header, check if the server returned a redirection if hstsHeader is None and 300 <= httpResp.status < 400: redirectHeader = httpResp.getheader('Location', None) cookieHeader = httpResp.getheader('Set-Cookie', None) if redirectHeader is None: break o = urlparse(redirectHeader) httpPath = o.path # Handle absolute redirection URL if o.hostname: if o.port: port = o.port else: if o.scheme == 'https': port = 443 elif o.scheme == 'http': # We would have to use urllib for http: URLs raise Exception("Error: server sent a redirection to HTTP.") else: port = target[2] target = (o.hostname, o.hostname, port, target[3]) # Handle cookies if cookieHeader: cookie = Cookie.SimpleCookie(cookieHeader) if cookie: httpAppend = 'Cookie:' + cookie.output(attrs=[], header='', sep=';') + '\r\n' nb_redirect+=1 else: # If the server did not return a redirection just give up break return hstsHeader
def _get_hsts_header(self, target): hstsHeader = None MAX_REDIRECT = 5 nb_redirect = 0 httpGetFormat = 'GET {0} HTTP/1.0\r\nHost: {1}\r\n{2}Connection: close\r\n\r\n'.format httpPath = '/' httpAppend = '' while nb_redirect < MAX_REDIRECT: sslConn = create_sslyze_connection(target, self._shared_settings) # Perform the SSL handshake sslConn.connect() sslConn.write(httpGetFormat(httpPath, target[0], httpAppend)) httpResp = parse_http_response(sslConn.read(2048)) sslConn.close() if httpResp.version == 9: # HTTP 0.9 => Probably not an HTTP response raise Exception('Server did not return an HTTP response') else: hstsHeader = httpResp.getheader('strict-transport-security', False) # If there was no HSTS header, check if the server returned a redirection if hstsHeader is None and 300 <= httpResp.status < 400: redirectHeader = httpResp.getheader('Location', None) cookieHeader = httpResp.getheader('Set-Cookie', None) if redirectHeader is None: break o = urlparse(redirectHeader) httpPath = o.path # Handle absolute redirection URL if o.hostname: if o.port: port = o.port else: if o.scheme == 'https': port = 443 elif o.scheme == 'http': # We would have to use urllib for http: URLs raise Exception( "Error: server sent a redirection to HTTP.") else: port = target[2] target = (o.hostname, o.hostname, port, target[3]) # Handle cookies if cookieHeader: cookie = Cookie.SimpleCookie(cookieHeader) if cookie: httpAppend = 'Cookie:' + cookie.output( attrs=[], header='', sep=';') + '\r\n' nb_redirect += 1 else: # If the server did not return a redirection just give up break return hstsHeader