Skip to content

Commit 6f20f02

Browse files
BulletdevBulletdev
committed
feat: implement aditional sec tests
1 parent 586068a commit 6f20f02

13 files changed

+2226
-0
lines changed

‎.pentest/front/check-content-security.sh‎

Lines changed: 181 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,181 @@
1+
#!/bin/bash
2+
# Content Security — Frontend (prostaff.gg)
3+
# Verifica disclosure de tecnologia, Referrer-Policy, cache em paginas
4+
# sensiveis, respostas de erro e headers desnecessarios
5+
6+
TARGET="${1:-https://prostaff.gg}"
7+
8+
GREEN='\033[0;32m'
9+
RED='\033[0;31m'
10+
YELLOW='\033[1;33m'
11+
CYAN='\033[0;36m'
12+
NC='\033[0m'
13+
14+
PASSED=0
15+
FAILED=0
16+
WARNED=0
17+
18+
echo ""
19+
echo -e "${CYAN}Content Security Audit — Frontend${NC}"
20+
echo -e "${CYAN}Target: ${TARGET}${NC}"
21+
echo "========================================"
22+
echo ""
23+
24+
test_pass() { echo -e "${GREEN}[PASS]${NC} $1"; PASSED=$((PASSED + 1)); }
25+
test_fail() { echo -e "${RED}[FAIL]${NC} $1"; FAILED=$((FAILED + 1)); }
26+
test_warn() { echo -e "${YELLOW}[WARN]${NC} $1"; WARNED=$((WARNED + 1)); }
27+
28+
HEADERS=$(curl -sI "${TARGET}" 2>/dev/null)
29+
30+
echo "--- Disclosure de Tecnologia ---"
31+
32+
# Server
33+
SERVER=$(echo "$HEADERS" | grep -i "^server:" | head -1 | tr -d '\r')
34+
if [ -z "$SERVER" ]; then
35+
test_pass "Server header — ausente"
36+
elif echo "$SERVER" | grep -qiE "nginx/[0-9]|apache/[0-9]|node/[0-9]|next.js/[0-9]"; then
37+
test_fail "Server header — revela versao: ${SERVER}"
38+
elif echo "$SERVER" | grep -qiE "nginx|apache|node"; then
39+
test_warn "Server header — revela tecnologia: ${SERVER}"
40+
else
41+
test_pass "Server header — generico: ${SERVER}"
42+
fi
43+
44+
# X-Powered-By
45+
XPOWERED=$(echo "$HEADERS" | grep -i "^x-powered-by:" | head -1 | tr -d '\r')
46+
if [ -z "$XPOWERED" ]; then
47+
test_pass "X-Powered-By — ausente"
48+
else
49+
test_fail "X-Powered-By — presente: ${XPOWERED}"
50+
fi
51+
52+
# Next.js version em header (algumas versoes expõem)
53+
NEXT_HEADER=$(echo "$HEADERS" | grep -i "^x-nextjs\|^x-next\b" | head -1 | tr -d '\r')
54+
if [ -n "$NEXT_HEADER" ]; then
55+
test_warn "Next.js header detectado: ${NEXT_HEADER}"
56+
fi
57+
58+
# Verifica se versao Next.js vaza no HTML
59+
HTML_SAMPLE=$(curl -sL "${TARGET}" --max-time 10 2>/dev/null | head -c 5000)
60+
NEXT_VERSION=$(echo "$HTML_SAMPLE" | grep -oP '"next":"[^"]+"' | head -1)
61+
if [ -n "$NEXT_VERSION" ]; then
62+
test_warn "Versao Next.js no HTML: ${NEXT_VERSION} (considere remover)"
63+
fi
64+
65+
echo ""
66+
echo "--- Referrer Policy ---"
67+
68+
REFERRER=$(echo "$HEADERS" | grep -i "^referrer-policy:" | head -1 | tr -d '\r')
69+
if [ -z "$REFERRER" ]; then
70+
test_fail "Referrer-Policy — ausente"
71+
elif echo "$REFERRER" | grep -qiE "no-referrer$|strict-origin$|strict-origin-when-cross-origin$"; then
72+
test_pass "Referrer-Policy — seguro: ${REFERRER}"
73+
elif echo "$REFERRER" | grep -qiE "unsafe-url|no-referrer-when-downgrade$"; then
74+
test_fail "Referrer-Policy — inseguro: ${REFERRER}"
75+
else
76+
test_warn "Referrer-Policy — verifique: ${REFERRER}"
77+
fi
78+
79+
echo ""
80+
echo "--- Cache-Control em Paginas Sensiveis ---"
81+
82+
check_frontend_cache() {
83+
local PATH_URL="$1"
84+
local LABEL="$2"
85+
local SHOULD_BE_PRIVATE="${3:-false}"
86+
87+
RESP=$(curl -sI "${TARGET}${PATH_URL}" --max-time 10 2>/dev/null)
88+
CODE=$(echo "$RESP" | head -1 | grep -oP '[0-9]{3}' | head -1)
89+
CACHE=$(echo "$RESP" | grep -i "^cache-control:" | head -1 | tr -d '\r')
90+
91+
if [ "$CODE" = "404" ] || [ "$CODE" = "301" ] || [ "$CODE" = "302" ]; then
92+
echo " ${LABEL} — HTTP ${CODE} (nao aplicavel)"
93+
return
94+
fi
95+
96+
if $SHOULD_BE_PRIVATE; then
97+
if echo "$CACHE" | grep -qiE "no-store|private"; then
98+
test_pass "${LABEL} — Cache-Control seguro: ${CACHE}"
99+
elif [ -z "$CACHE" ]; then
100+
test_warn "${LABEL} — Cache-Control ausente (pagina autenticada pode ser cacheada por proxy)"
101+
else
102+
test_warn "${LABEL} — Cache-Control: ${CACHE}"
103+
fi
104+
else
105+
if echo "$CACHE" | grep -qi "no-store"; then
106+
test_warn "${LABEL} — no-store em pagina publica (pode impactar performance)"
107+
else
108+
test_pass "${LABEL} — Cache-Control: ${CACHE:-padrao}"
109+
fi
110+
fi
111+
}
112+
113+
check_frontend_cache "/" "GET / (home)" false
114+
check_frontend_cache "/dashboard" "GET /dashboard" true
115+
check_frontend_cache "/login" "GET /login" false
116+
check_frontend_cache "/profile" "GET /profile" true
117+
check_frontend_cache "/settings" "GET /settings" true
118+
119+
echo ""
120+
echo "--- Respostas de Erro ---"
121+
122+
# 404 nao deve revelar stack trace
123+
RESP_404=$(curl -sL "${TARGET}/pagina-que-nao-existe-xyz999" --max-time 10 2>/dev/null)
124+
if echo "$RESP_404" | grep -qiE "traceback|stack.trace|at Object\.|webpack|__NEXT_DATA__.*error"; then
125+
test_fail "404 — pode revelar informacoes de debug"
126+
elif echo "$RESP_404" | grep -qiE "Next.js [0-9]|react [0-9]"; then
127+
test_warn "404 — versao de framework exposta na pagina de erro"
128+
else
129+
test_pass "404 — resposta sem disclosure"
130+
fi
131+
132+
echo ""
133+
echo "--- Headers de Seguranca Extras ---"
134+
135+
# Permissions-Policy
136+
PPOLICY=$(echo "$HEADERS" | grep -i "^permissions-policy:" | head -1 | tr -d '\r')
137+
if [ -z "$PPOLICY" ]; then
138+
test_warn "Permissions-Policy — ausente"
139+
else
140+
test_pass "Permissions-Policy — ${PPOLICY}"
141+
fi
142+
143+
# Cross-Origin-Opener-Policy
144+
COOP=$(echo "$HEADERS" | grep -i "^cross-origin-opener-policy:" | head -1 | tr -d '\r')
145+
if [ -z "$COOP" ]; then
146+
test_warn "Cross-Origin-Opener-Policy — ausente (protecao contra Spectre/side-channel)"
147+
elif echo "$COOP" | grep -qiE "same-origin|same-origin-allow-popups"; then
148+
test_pass "COOP — ${COOP}"
149+
else
150+
test_warn "COOP — verifique o valor: ${COOP}"
151+
fi
152+
153+
# Cross-Origin-Resource-Policy
154+
CORP=$(echo "$HEADERS" | grep -i "^cross-origin-resource-policy:" | head -1 | tr -d '\r')
155+
if [ -z "$CORP" ]; then
156+
test_warn "Cross-Origin-Resource-Policy — ausente"
157+
else
158+
test_pass "CORP — ${CORP}"
159+
fi
160+
161+
echo ""
162+
echo "--- Open Graph / Meta (disclosure em HTML) ---"
163+
164+
# Verifica se ha info sensivel em meta tags
165+
META_CONTENT=$(echo "$HTML_SAMPLE" | grep -iP '<meta[^>]+(name|property)=[^>]+content=[^>]+>' | head -10)
166+
if echo "$META_CONTENT" | grep -qiE "version|build|commit|sha|hash|deploy"; then
167+
test_warn "Meta tags podem expor info de build/deploy:"
168+
echo "$META_CONTENT" | grep -iE "version|build|commit|sha|hash|deploy" | head -3 | while read -r m; do
169+
echo " ${YELLOW}>${NC} ${m:0:100}"
170+
done
171+
else
172+
test_pass "Meta tags — sem info de build/deploy detectada"
173+
fi
174+
175+
echo ""
176+
echo "========================================"
177+
echo -e "Resultado: ${GREEN}${PASSED} PASS${NC} | ${RED}${FAILED} FAIL${NC} | ${YELLOW}${WARNED} WARN${NC}"
178+
echo ""
179+
180+
[ "$FAILED" -gt 0 ] && exit 1
181+
exit 0

‎.pentest/front/check-cookies.sh‎

Lines changed: 150 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,150 @@
1+
#!/bin/bash
2+
# Cookie Security — Frontend (prostaff.gg)
3+
# Verifica flags de seguranca nos cookies do Next.js:
4+
# auth cookies, session, CSRF tokens
5+
6+
TARGET="${1:-https://prostaff.gg}"
7+
8+
GREEN='\033[0;32m'
9+
RED='\033[0;31m'
10+
YELLOW='\033[1;33m'
11+
CYAN='\033[0;36m'
12+
NC='\033[0m'
13+
14+
PASSED=0
15+
FAILED=0
16+
WARNED=0
17+
18+
echo ""
19+
echo -e "${CYAN}Cookie Security Audit — Frontend${NC}"
20+
echo -e "${CYAN}Target: ${TARGET}${NC}"
21+
echo "========================================"
22+
echo ""
23+
24+
test_pass() { echo -e "${GREEN}[PASS]${NC} $1"; PASSED=$((PASSED + 1)); }
25+
test_fail() { echo -e "${RED}[FAIL]${NC} $1"; FAILED=$((FAILED + 1)); }
26+
test_warn() { echo -e "${YELLOW}[WARN]${NC} $1"; WARNED=$((WARNED + 1)); }
27+
28+
check_cookie() {
29+
local LABEL="$1"
30+
local COOKIE_LINE="$2"
31+
32+
echo -e "\n Cookie: ${YELLOW}${LABEL}${NC}"
33+
echo " Raw: $(echo "$COOKIE_LINE" | tr -d '\r')"
34+
35+
# Secure flag
36+
if echo "$COOKIE_LINE" | grep -qi "; Secure\b"; then
37+
test_pass " Secure flag — presente"
38+
else
39+
test_fail " Secure flag — ausente"
40+
fi
41+
42+
# HttpOnly flag
43+
if echo "$COOKIE_LINE" | grep -qi "; HttpOnly\b"; then
44+
test_pass " HttpOnly flag — inacessivel via JS"
45+
else
46+
test_fail " HttpOnly flag — ausente (vulneravel a XSS)"
47+
fi
48+
49+
# SameSite
50+
if echo "$COOKIE_LINE" | grep -qi "SameSite=Strict"; then
51+
test_pass " SameSite=Strict"
52+
elif echo "$COOKIE_LINE" | grep -qi "SameSite=Lax"; then
53+
test_pass " SameSite=Lax"
54+
elif echo "$COOKIE_LINE" | grep -qi "SameSite=None"; then
55+
if echo "$COOKIE_LINE" | grep -qi "; Secure"; then
56+
test_warn " SameSite=None + Secure (cookie cross-site intencional?)"
57+
else
58+
test_fail " SameSite=None sem Secure — configuracao invalida"
59+
fi
60+
else
61+
test_warn " SameSite — ausente"
62+
fi
63+
64+
# Path scope
65+
COOKIE_PATH=$(echo "$COOKIE_LINE" | grep -oiP "Path=[^;]+")
66+
if [ -n "$COOKIE_PATH" ]; then
67+
test_pass " ${COOKIE_PATH}"
68+
else
69+
test_warn " Path — nao definido (padrao: /)"
70+
fi
71+
72+
# Domain scope
73+
DOMAIN_SCOPE=$(echo "$COOKIE_LINE" | grep -oiP "Domain=[^;]+")
74+
if [ -n "$DOMAIN_SCOPE" ]; then
75+
if echo "$DOMAIN_SCOPE" | grep -qP "Domain=\\."; then
76+
test_warn " ${DOMAIN_SCOPE} — prefixo ponto (vale para todos subdomains)"
77+
else
78+
test_pass " ${DOMAIN_SCOPE}"
79+
fi
80+
fi
81+
82+
# Duracao
83+
MAX_AGE=$(echo "$COOKIE_LINE" | grep -oiP "Max-Age=\K[0-9]+")
84+
EXPIRES=$(echo "$COOKIE_LINE" | grep -oiP "Expires=[^;]+")
85+
if [ -n "$MAX_AGE" ]; then
86+
DAYS=$(( MAX_AGE / 86400 ))
87+
if [ "$DAYS" -gt 30 ]; then
88+
test_warn " Max-Age=${MAX_AGE} (${DAYS} dias) — duracao longa, verifique se e necessario"
89+
else
90+
test_pass " Max-Age=${MAX_AGE} (${DAYS} dias)"
91+
fi
92+
elif [ -n "$EXPIRES" ]; then
93+
test_warn " ${EXPIRES}"
94+
else
95+
test_pass " Session cookie (expira ao fechar browser)"
96+
fi
97+
}
98+
99+
echo "--- Cookies em GET / ---"
100+
101+
HOME_COOKIES=$(curl -sI "${TARGET}" 2>/dev/null | grep -i "^set-cookie:")
102+
103+
if [ -z "$HOME_COOKIES" ]; then
104+
echo " Nenhum cookie em GET /"
105+
else
106+
while IFS= read -r LINE; do
107+
NAME=$(echo "$LINE" | grep -oP "set-cookie:\s*\K[^=]+" | head -1 | xargs)
108+
check_cookie "$NAME" "$LINE"
109+
done <<< "$HOME_COOKIES"
110+
fi
111+
112+
echo ""
113+
echo "--- Cookies em paginas autenticadas ---"
114+
echo " (simulando navegacao para detectar cookies de sessao)"
115+
116+
FOLLOW_COOKIES=$(curl -sI -L "${TARGET}/dashboard" 2>/dev/null | grep -i "^set-cookie:")
117+
118+
if [ -z "$FOLLOW_COOKIES" ]; then
119+
echo " Nenhum cookie adicional em /dashboard"
120+
else
121+
while IFS= read -r LINE; do
122+
NAME=$(echo "$LINE" | grep -oP "set-cookie:\s*\K[^=]+" | head -1 | xargs)
123+
check_cookie "$NAME" "$LINE"
124+
done <<< "$FOLLOW_COOKIES"
125+
fi
126+
127+
echo ""
128+
echo "--- Verificacoes de Contexto ---"
129+
130+
# Verifica se ha cookies de CSRF
131+
ALL_COOKIES=$(curl -sI "${TARGET}" 2>/dev/null | grep -i "^set-cookie:" | tr -d '\r')
132+
133+
if echo "$ALL_COOKIES" | grep -qi "csrf\|xsrf\|_token"; then
134+
test_pass "Token CSRF detectado nos cookies"
135+
else
136+
test_warn "Token CSRF nao detectado — Next.js usa Server Actions? Verifique protecao CSRF"
137+
fi
138+
139+
# Verifica se cookies de auth estao sendo expostos (nao devem ter valores visiveis em resposta publica)
140+
if echo "$ALL_COOKIES" | grep -qiE "access.token|refresh.token|jwt|authorization"; then
141+
test_warn "Cookie com nome sugestivo de token de auth detectado — verifique se esta HttpOnly"
142+
fi
143+
144+
echo ""
145+
echo "========================================"
146+
echo -e "Resultado: ${GREEN}${PASSED} PASS${NC} | ${RED}${FAILED} FAIL${NC} | ${YELLOW}${WARNED} WARN${NC}"
147+
echo ""
148+
149+
[ "$FAILED" -gt 0 ] && exit 1
150+
exit 0

0 commit comments

Comments
 (0)