iis-vuln-check.ps1

################################Ignore Self Signed Certificates################################################
# Create a custom SSL validation callback that accepts all certificates
Add-Type -TypeDefinition @"
    using System;
    using System.Net;
    using System.Net.Security;
    using System.Security.Cryptography.X509Certificates;
    
    public class SSLValidator {
        public static void Ignore() {
            ServicePointManager.ServerCertificateValidationCallback = 
                new RemoteCertificateValidationCallback( 
                    delegate { return true; } 
                );
        }
    }
"@

# Call the SSL validation callback to ignore certificate validation
[SSLValidator]::Ignore()

################################Ignore Self Signed Certificates################################################

function CheckSecurityHeaders {
    param (
        [string]$url
    )

    $response = Invoke-WebRequest -Uri $url 
    if ($response -eq $null) {
        throw "Failed to retrieve headers from $url"
    }

    $headers = $response.Headers
    if ($headers -eq $null) {
        throw "Failed to retrieve headers from the response"
    }

    $requiredHeaders = @{
        "Strict-Transport-Security" = "CVE-2019-13498 :`nNot using HTTP Strict Transport Security (HSTS) may lead to man-in-the-middle (MITM) attacks." 
        "X-Content-Type-Options" = "CVE-2018-17031 : `nan attacker can use a crafted .eml file to trigger MIME type sniffing, which leads to XSS, as demonstrated by Internet Explorer, `nbecause an X-Content-Type-Options: nosniff header is not sent."
        "X-Frame-Options" = "CVE-2022-3260 : `nThe response header has not enabled X-FRAME-OPTIONS, Which helps prevents against Clickjacking attack."
        "X-XSS-Protection" = "CVE-2018-7504 : `nThe X-XSS-Protection response header is not set to block, allowing attempts at reflected cross-site scripting"
        "Content-Security-Policy" = "CVE-2018-5164 : `nContent Security Policy (CSP) is not applied correctly to all parts of multipart content sent with the multipart/x-mixed-replace MIME type"
        
    }

    $missingHeaders = @()
    foreach ($header in $requiredHeaders.GetEnumerator()) {
        if (!$headers.ContainsKey($header.Key)) {
            $missingHeaders += [PSCustomObject]@{
                Header = $header.Key
                CVE = $header.Value
            }
        }
    }

    return $missingHeaders
}

function CheckInsecureCookies {
    param(
        [string]$url
    )

    $response = Invoke-WebRequest -Uri $url
    $cookies = $response.Headers["Set-Cookie"]

    $insecureCookies = @()
    $cookiesWithoutHttpOnly = @()
    $cookiesWithoutSameSite = @()

    foreach ($cookie in $cookies) {
        if ($cookie -notlike "*Secure*") {
            $cookieName = ($cookie -split ";")[0]
            $insecureCookies += $cookieName
        }

        if ($cookie -notlike "*HttpOnly*") {
            $cookieName = ($cookie -split ";")[0]
            $cookiesWithoutHttpOnly += $cookieName
        }

        if ($cookie -notlike "*SameSite*") {
            $cookieName = ($cookie -split ";")[0]
            $cookiesWithoutSameSite += $cookieName
        }
    }

    $result = @{
        "InsecureCookies" = $insecureCookies
        "CookiesWithoutHttpOnly" = $cookiesWithoutHttpOnly
        "CookiesWithoutSameSite" = $cookiesWithoutSameSite
    }

    return $result
}


function CheckIISAndASPNETVersions {
    param(
        [string]$url
    )

    $headers = Invoke-WebRequest -Uri $url | Select-Object -ExpandProperty Headers

    $iisVersion = $headers['Server']
    $aspNetVersion = $headers['X-AspNet-Version']
    $aspPoweredBy = $headers['X-Powered-By']

    $result = @{}

    if ($iisVersion) {
        $result['IISVersion'] = $iisVersion
    }

    if ($aspNetVersion) {
        $result['ASPNETVersion'] = $aspNetVersion
    }

    if ($aspNetVersion) {
        $result['X-Powered-By'] =  $aspPoweredBy
    }

    return $result 
    Write-Host "Following Header needs to be remove: " $result -ForegroundColor Red 
}

function CheckTLSVersions {
    param(
        [string]$url
    )

    $request = [System.Net.HttpWebRequest]::Create($url)
    $request.Method = "HEAD"

    try {
        $response = $request.GetResponse()
        $tlsVersion = $response.ProtocolVersion

        if ($tlsVersion -eq "Tls" -or $tlsVersion -eq "Tls11") {
            return $true
        } else {
            return $false
        }
    } catch {
        # In case of an error, assume that TLS 1.0 or TLS 1.1 is not supported.
        return $false
    }
}

function CheckHttpsRedirect {
    param (
        [string]$url
    )

    $response = Invoke-WebRequest -Uri $url -MaximumRedirection 0 -ErrorAction SilentlyContinue
    if ($response -eq $null) {
        return $false
    }

    $statusCode = $response.StatusCode
    if ($statusCode -eq 301 -or $statusCode -eq 302) {
        return $true
    } else {
        return $false
    }
}

$targetUrl = Read-Host "Domain to check (e.g., example.com)"
$successCount = 10
$output = @()
$output += "`n`n`nVULNERABILITY REPORT FOR DOMAIN: $targetUrl`n`n`n"
# Replace 'http://example.com' with the URL of your ASP.NET app
# Prompt the user for the domain to check




# Add "https://" to the beginning if not provided by the user
if (-not ($targetUrl -like "https://*") -and -not ($targetUrl -like "http://*")) {
    $targetUrl =  "http://$targetUrl"
}


$output += "`n`nHTTP to HTTPS Redirect Result:"

$isHttpsRedirect = CheckHttpsRedirect -url $targetUrl
if ($isHttpsRedirect) {
Write-Host    "++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ " -ForegroundColor Green 
    Write-Host "Domain is redirected to HTTPS scheme." -ForegroundColor Green
Write-Host    "++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ " -ForegroundColor Green 
$output += "`nDomain is redirected to HTTPS scheme."
} else {
Write-Host    "------------------------------------------------------------------ " -ForegroundColor Red 
    Write-Host "No HTTPS redirect found! Go Check CVE-2022-22797" -ForegroundColor Red
Write-Host    "------------------------------------------------------------------ " -ForegroundColor Red 
$successCount = $successCount-0.5
$output += "`nNo HTTPS redirect found! Go Check CVE-2022-22797"
 $output +="`nRisk: MEDIUM."
 $output+= "`n1.Install the URL Rewrite Module:
`nIf you haven't already installed the URL Rewrite Module, you can download and install it from the Microsoft website or use the Web Platform Installer.

`n2.Open IIS Manager:
Open Internet Information Services (IIS) Manager on your server.

`n3.Select Your Website:
`nIn the left-hand pane, navigate to your website (or the specific application) for which you want to enforce HTTPS.

`n4.Open URL Rewrite Feature:
`nDouble-click on the URL Rewrite feature in the middle pane.

`n5.Add a Rule:
`nIn the URL Rewrite module, click Add Rule(s) on the right-hand side.

`n6.Choose Blank Rule:
`nSelect Blank Rule from the Inbound Rule templates.

`n7.Configure the Rule:
`nFill in the following details:
`nName: Give your rule a name (e.g., HTTP to HTTPS Redirect).
`nRequested URL: Choose Matches the Pattern.
`nUsing: Choose Regular Expressions.
`nPattern: Use (.*) to match any URL.
`nIgnore case: Checked.
`nAction Type: Choose Redirect.
`nRedirect URL: Use https://{HTTP_HOST}/{R:1} to redirect to HTTPS.
`nRedirect type: Choose Permanent (301) for a permanent redirect.
`n7.Click Apply in the right-hand pane to save the rule and apply it to your website."
}


$output += "`n----------------------------------------------------------------"
$output += "`nMissing Security Headers Result:"

$missingHeaders = CheckSecurityHeaders -url $targetUrl
$insecureCookiesResult = CheckInsecureCookies -url $targetUrl
$insecureCookies = $insecureCookiesResult["InsecureCookies"]
$cookiesWithoutHttpOnly = $insecureCookiesResult["CookiesWithoutHttpOnly"]
$iisAndAspNetVersions = CheckIISAndASPNETVersions -url $targetUrl

$missingHeaders = CheckSecurityHeaders -url $targetUrl
if ($missingHeaders.Count -gt 0) {
    Write-Host "Missing The Following Security Headers:"
    
    $missingHeaders | Format-Table -AutoSize -Property Header, CVE 
    
   Write-Host     "++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ " -ForegroundColor DarkYellow
    Write-Host    "++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ " -ForegroundColor DarkYellow 

    $successCount = $successCount-3
    $headers = $missingHeaders | ForEach-Object { $_.Header }
    $cves = $missingHeaders | ForEach-Object { $_.CVE }
    $output += "`nMissing security headers: `n$($headers -join ', ')`nRelated CVE's: `n$($cves -join ', ')`n"
     $output +="`nRisk: HIGH."
     $output +="`nPossible Solution: `nOn IIS, go to Response Headers, right click and add the desired header name and its value."
} else {
    Write-Host "All required security headers are present." -ForegroundColor Green 
     $output += "`nAll required security headers are present."
}


$output += "`n----------------------------------------------------------------"
$output += "`nInsecure Cookies Check:"

if ($insecureCookies.Count -gt 0) {

    Write-Host    "------------------------------------------------------------------ " 
    Write-Host "Insecure cookies found:"
    $insecureCookies | ForEach-Object { Write-Host "  $_" -ForegroundColor Red } 
    
    Write-Host    "------------------------------------------------------------------ " 
    $successCount = $successCount--
    $output += "`nInsecure cookies found: $insecureCookies"
    $output +="`nInsecure cookies can lead to various security risks, including session hijacking, cross-site scripting (XSS) attacks, and man-in-the-middle attacks."
    $output +="`nRisk: Medium."
} else {
Write-Host    "+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ "
    Write-Host "No Insecured cookies found." -ForegroundColor Green 
Write-Host    "+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ "
$output += "`nNo Insecured cookies found."
}

if ($cookiesWithoutHttpOnly.Count -gt 0) {
    Write-Host    "------------------------------------------------------------------ "
    Write-Host "Cookies without HttpOnly attribute found:"
   
    $cookiesWithoutHttpOnly | ForEach-Object { Write-Host "  $_" -ForegroundColor Red }
    Write-Host    "------------------------------------------------------------------ "
   $successCount = $successCount-0.5
   $output += "`nCookies without HttpOnly attribute found: $cookiesWithoutHttpOnly "
    $output += "`nVulnerability Description:Not using the HttpOnly attribute may lead to client-side scripts to access cookies, increasing the risk of XSS attacks"
    $output += "`nRisk: MEDIUM"
} else {
Write-Host    "+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ "
    Write-Host "Did not find and cookies without HttpOnly attribute." -ForegroundColor Green 
Write-Host    "+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ "
$output += "`nDid not find and cookies without HttpOnly attribute."
}

if ($cookiesWithoutSameSite.Count -gt 0) {
    Write-Host    "------------------------------------------------------------------ "
    Write-Host "Cookies without SameSite attribute found:"
   
    $cookiesWithoutHttpOnly | ForEach-Object { Write-Host "  $_" -ForegroundColor Red }
    Write-Host    "------------------------------------------------------------------ "
   $successCount = $successCount-0.5
   $output += "`nCookies without HttpOnly attribute found: $cookiesWithoutSameSite "
    $output += "`nThe SameSite attribute is a relatively new feature in web browsers that helps control how cookies are sent in cross-origin requests.
    `nNot using the SameSite attribute for cookies can introduce security risks, particularly related to Cross-Site Request Forgery (CSRF) attacks and user privacy. "
    $output += "`nRisk: MEDIUM"
} else {
Write-Host    "+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ "
    Write-Host "Did not find and cookies without SameSite attribute." -ForegroundColor Green 
Write-Host    "+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ "
$output += "`nDid not find and cookies without SameSite attribute."
}



$output += "`n----------------------------------------------------------------"
$output += "`nHeaders Containing Information Disclosure about Web Server:"

if ($iisAndAspNetVersions['IISVersion']) {
  Write-Host    "------------------------------------------------------------------ "
    Write-Host "`nIIS Version Header Found: $($iisAndAspNetVersions['IISVersion']). Go Check " 
    Write-Host "CVE-2020-0645" -ForegroundColor Red -NoNewline
    Write-Host ", " -NoNewline
    Write-Host "CVE-2011-5279" -ForegroundColor Red
    $output += "`nIIS Version Header Found: $($iisAndAspNetVersions['IISVersion']). Realted Vulnerabilities: `nCVE-2020-0645 `nCVE-2011-5279"
     
  Write-Host    "------------------------------------------------------------------ "
  Write-Host    "++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ "
Write-Host " `nSuggested Solution`n: `n1.Open IIS  `n2.Click on Server Name.`n3.Open the Configuration Editor `n4.Open the dropdown `n7.go to System.Web/Security `n8.switch RemoveServerHeader to true." -ForegroundColor Green
    $output += "`nSuggested Solution`n: `n1.Open IIS  `n2.Click on Server Name.`n3.Open the Configuration Editor `n4.Open the dropdown `n7.go to System.Web/Security `n8.switch RemoveServerHeader to true.
    and click on 'Save."
     $output +="`nRisk: MEDIUM."
Write-Host   "++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ "
$successCount = $successCount-0.5
}
else{
  Write-Host    "+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ " 
    Write-Host "No IIS Version Header ['IISVersion'] Was Found." -ForegroundColor Green
  Write-Host    "+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ " 
  $output += "No IIS Version Header ['IISVersion'] Was Found."
 
}


if ($iisAndAspNetVersions['ASPNETVersion']) { 
 Write-Host    "------------------------------------------------------------------ " 
    Write-Host "`nWarning: ASP.NET Header Version Was Found: $($iisAndAspNetVersions['ASPNETVersion'])" -ForegroundColor DarkYellow
 Write-Host    "------------------------------------------------------------------ "
  $successCount = $successCount-0.5
  $output +="`nWarning: ASP.NET Header Version Was Found: $($iisAndAspNetVersions['ASPNETVersion'])"
  $output +="`nRisk: MEDIUM."
  $output += "`n Solution: `n1.Open the web.config file of your ASP.NET web application. `nLocate the <system.web> section, and within it, add the following: 
  `n<httpRuntime> : 
  `n<system.web> 
  `n<httpRuntime enableVersionHeader='false'/>
  `n</system.web>"
}

else{
  Write-Host    "+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ " 
    Write-Host "No ASP.NET Version Header ['ASPNETVersion'] Was Found." -ForegroundColor Green
  Write-Host    "+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ " 
  $output +="`nNo ASP.NET Version Header ['ASPNETVersion'] Was Found."
}

if ($iisAndAspNetVersions['X-Powered-By']) {
 Write-Host    "------------------------------------------------------------------ " 
    Write-Host "`nWarning: ASP.NET Header Version Was Found: $($iisAndAspNetVersions['X-Powered-By']). Go Check CWE-200 for more details." -ForegroundColor DarkYellow
 Write-Host    "------------------------------------------------------------------ " 
     $successCount = $successCount-1
     $output +="`nWarning: ASP.NET Header Version Was Found: $($iisAndAspNetVersions['X-Powered-By']).Warning: An X-Powered-By header was found. Value: $XPoweredBy. `nRelated vulnerability: `nCWE-200. `nShort Description:The web/application server is leaking information via one or more X-Powered-By HTTP response headers. 
        `nAccess to such information may facilitate attackers identifying other frameworks/components your web application is reliant 
        `nupon and the vulnerabilities such components may be subject to."
     $output +="`nRisk: MEDIUM."
      $output += "`nSuggested Solution: `n1.Open IIS  `n2.Click on Server Name 3.`n4.Click On Response Headers `n5.Right click on the X-Powered-By and Remove it."
}
else{
Write-Host    "+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ " 
        Write-Host "No Framework Header ['X-Powered-By'] Was Found." -ForegroundColor Green
Write-Host    "+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ " 
 $output +="`nNo Framework Header ['X-Powered-By'] Was Found."
}
$output += "`n----------------------------------------------------------------"


$output += "`n----------------------------------------------------------------"
$output += "`n`n`n`nTLS Version Check:"

$insecureTLS = CheckTLSVersions -url $targetUrl
if ($insecureTLS) {
 Write-Host    "------------------------------------------------------------------ " 
    Write-Host "`nWarning: Insecure TLS version (TLS 1.0 or TLS 1.1) is supported by the domain SSL certificate. `n Consider using an SSL with a higher TLS version." -ForegroundColor -ForegroundColor DarkYellow
    Write-Host "`nRisk: HIGH"
 Write-Host    "------------------------------------------------------------------ " 
 $successCount = $successCount-1
  $output += "`n`nWarning: Insecure TLS version (TLS 1.0 or TLS 1.1) is supported by the domain SSL certificate. `n Consider using an SSL with a higher TLS version."
   $output +="`nRisk: HIGH."
}
else{
Write-Host    "+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ " 
  Write-Host "No 1.1 or 1.0 TLS versions found on target domain: " $targetUrl -ForegroundColor Green
Write-Host    "+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ " 
 $output += "`n`nNo 1.1 or 1.0 TLS versions found on target domain: $targetUrl " 
}


$output += "`n`nAfter Everything Checked, this is the following calculted score:"

# Check if all checks were successful (all results are green)
if ($successCount -eq 10) {
    Write-Host "Total result score: 10/10" -ForegroundColor Green
    $output += "`n`n`nTotal result score: $successCount/10"
} elseif ($successCount -gt 6) {
    Write-Host "Total result score: $successCount/10" -ForegroundColor DarkYellow
    $output += "`n`n`nTotal result score: $successCount/10"
} else {
    Write-Host "Total result score: $successCount/10" -ForegroundColor Red
    $output += "`n`n`nTotal result score: $successCount/10"
}
$output += "`n----------------------------------------------------------------"


function ConvertTo-PDF {
    param (
        [string]$Source,
        [string]$Destination
    )

    try {
        $word = New-Object -ComObject Word.Application
        $word.Visible = $false
        $doc = $word.Documents.Open($Source)
        $doc.SaveAs([ref]$Destination, [ref]17)
        $doc.Close()
        $word.Quit()

        Write-Host "PDF created: $Destination" -ForegroundColor Green
    }
    catch {
        Write-Host "Failed to create PDF: $_" -ForegroundColor Red
    }
}

# Prompt the user to export a PDF results file
$exportToPdf = Read-Host "Would you like to export a PDF results file (y/n)?"
if ($exportToPdf -eq "y" -or $exportToPdf -eq "Y") {
# Save the output to a text file
$outputFilePath = "$env:TEMP\script_output.txt"
$output | Out-File -FilePath $outputFilePath -Encoding UTF8

# Convert the text file to PDF
$pdfFilePath = Read-Host "Enter the PDF file path to save the results (e.g., C:\Path\To\Results.pdf)"
ConvertTo-PDF -Source $outputFilePath -Destination $pdfFilePath
}


else {
    Write-Host "Done checking."
}