metasploit-framework/modules/auxiliary/scanner/http/http_hsts.rb

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
#   http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Auxiliary

  include Msf::Exploit::Remote::HttpClient
  include Msf::Auxiliary::Scanner

  def initialize(info={})
    super(update_info(info,
      'Name'        => 'HTTP Strict Transport Security (HSTS) Detection',
      'Description' => %q{
        Display HTTP Strict Transport Security (HSTS) information about each system.
      },
      'Author'      => 'Matt "hostess" Andreko <mandreko[at]accuvant.com>',
      'License'     => MSF_LICENSE
    ))

    register_options([
        OptBool.new('SSL', [ true, "Negotiate SSL for outgoing connections", true]),
        Opt::RPORT(443)
      ])
  end

  def run_host(ip)
    begin
      res = send_request_cgi({
        'uri'    => '/',
        'method' => 'GET',
        }, 25)

      if res
        hsts = res.headers['Strict-Transport-Security']

        if hsts
          print_good("#{ip}:#{rport} - Strict-Transport-Security:#{hsts}")
          report_note({
            :data => hsts,
            :type => "hsts.data",
            :host => ip,
            :port => rport
          })
        else
          print_error("#{ip}:#{rport} No HSTS found.")
        end
      else
        print_error("#{ip}:#{rport} No headers were returned.")
      end

    rescue ::Timeout::Error, ::Errno::EPIPE
    end
  end

end