Home

🛡️ HTTP Header Analyzer

A security-focused HTTP header analyzer written in Go, with TLS inspection, security scoring, SSRF protection, a REST API, and a cyberpunk web dashboard.

🚀 Overview

http-header-analyzer analyzes HTTP/HTTPS targets and identifies security-related configuration issues.

It evaluates areas such as:

🔐 Security headers
🍪 Cookie security
🔒 TLS configuration
↪️ Redirect behavior
🌐 CORS configuration
🛡️ SSRF-sensitive target handling
📡 HTTP methods
🔎 Technology disclosure
📄 security.txt
🚨 Information disclosure
📊 Security scoring and ratings

The project is designed for security researchers, developers, penetration testers, and anyone who wants a quick security-oriented view of an HTTP endpoint.

✨ Features

Security Analysis

Analyze commonly used HTTP security controls including:

Content Security Policy
Strict-Transport-Security
X-Content-Type-Options
X-Frame-Options
Cookie security attributes
CORS configuration
HTTP method exposure

🔒 TLS Inspection

Inspect HTTPS configuration and certificate information, including:

TLS version
Certificate metadata
Certificate validity
Handshake information
Weak or potentially insecure configurations

🛡️ SSRF Protection

The analyzer includes defensive URL and network validation to reduce the risk of scanning internal or reserved network targets.

Protection covers areas such as:

Loopback addresses
Private IPv4 ranges
Private IPv6 ranges
Link-local addresses
Multicast and unspecified addresses
Unsafe redirect targets
Restricted URL forms

📊 Security Scoring

Scan results are converted into a security score and rating to make findings easier to understand and integrate into automated workflows.

💻 CLI

The project provides a command-line interface for automated and manual scanning.

Example:

./http-header-analyzer scan https://example.com

JSON output:

./http-header-analyzer scan --json https://example.com

Quality gates:

./http-header-analyzer scan --min-score 80 https://example.com
./http-header-analyzer scan --fail-on high https://example.com

🌐 REST API

The project also provides an HTTP API for integrating analysis into other applications and security workflows.

🏗️ Architecture

The project is organized around several main components:

http-header-analyzer/
├── cmd/
│   ├── http-header-analyzer/
│   └── server/
│
├── internal/
│   ├── analyzer/
│   ├── api/
│   ├── models/
│   └── validation/
│
├── web/
│
├── tests/
│
├── .github/
│   └── workflows/
│
├── CHANGELOG.md
├── CONTRIBUTING.md
├── SECURITY.md
└── README.md

Core flow

Target URL
    │
    ▼
URL Validation
    │
    ▼
Safe Network Connection
    │
    ▼
HTTP Request
    │
    ├── Headers
    ├── Cookies
    ├── TLS
    ├── Redirects
    ├── CORS
    ├── Methods
    └── Other Analysis
    │
    ▼
Security Rules
    │
    ▼
Score & Findings
    │
    ├── CLI
    ├── JSON
    ├── REST API
    └── Web Dashboard

🧪 Development

Requirements:

Go 1.21+
Git

Run tests:

go test ./...

Run static analysis:

go vet ./...

Build the project:

go build ./...

Run the server:

go run ./cmd/server

🔄 CI & Security

The repository uses GitHub Actions for automated verification.

Current automation includes:

🧪 Go tests
🔍 go vet
🏗️ Go builds
🛡️ CodeQL security analysis
🤖 Dependabot dependency updates

The CodeQL workflow analyzes Go code on pull requests, pushes to main, and scheduled security scans.

📚 Documentation

Useful documentation:

README — Project overview and quick start
CHANGELOG — Version history and development milestones
CONTRIBUTING — Contribution and development guidelines
SECURITY — Security vulnerability reporting policy

Additional wiki pages can cover individual components in greater depth.

🗺️ Roadmap

The current development roadmap focuses on:

🛡️ Expanded security regression testing
🔒 Improved TLS analysis
⚡ Extended CLI capabilities
📦 Automated releases
📚 Improved API documentation
🔍 Additional security tooling

🤝 Contributing

Contributions are welcome.

Before submitting a pull request:

go test ./...
go vet ./...
go build ./...

For security vulnerabilities, please follow the project's security reporting process rather than opening a public issue.

📄 License

See the repository's LICENSE file for licensing information.

http-header-analyzer — inspect deeper. Secure smarter. 🛡️

Navigation Menu

Repository navigation