开发者

Script HTTPS call for vulnerability test verification

I'm trying to demonstrate to our QA department that we have (or have not) fixed a vulnerability shown in a recent scan. I would like to write a simple script that can demonstrate the vulnerability and show that the remediation actually fixes it. However since the vulnerability involves a invali开发者_Python百科d (possibly intentionally) HTTPS request I can't use a standard client to easily replicate it. Because there are several servers to test and several different vulnerabilities I would like to automate the testing a bit.

The following command line replicates the test but requires human intervention:

>openssl s_client -connect {server:ip} | grep Location
GET /images HTTP/1.0 <---- (user types this plus two Enter keys)

Location:{text here proves success/failure}

How can I automate the test above?

I'm using openssl because it's convenient. I'm willing to get another tool if it can accept arbitrary HTTPS request headers.


In bash you can just pipe your text into the OpenSSL command-line utility:

printf 'GET /images HTTP/1.0\r\n\r\n' | openssl s_client -connect {server:ip} | grep Location
0

上一篇:

下一篇:

精彩评论

暂无评论...
验证码 换一张
取 消

最新问答

问答排行榜