nginx-vuln-check.ps1

function CheckSecurityHeaders {
    param (
        [string]$url
    )

    $response = Invoke-WebRequest -Uri $url -ErrorAction Stop
    if ($response -eq $null) {
        throw "Failed to retrieve headers from $url"
    }

    $headers = $response.Headers
    if ($headers -eq $null) {
        throw "Failed to retrieve headers from the response"
    }

    $requiredHeaders = @{
        "Strict-Transport-Security" = "CVE-2019-13498 :`nNot using HTTP Strict Transport Security (HSTS) may lead to man-in-the-middle (MITM) attacks." 
        "X-Content-Type-Options" = "CVE-2018-17031 : `nan attacker can use a crafted .eml file to trigger MIME type sniffing, which leads to XSS, as demonstrated by Internet Explorer, `nbecause an X-Content-Type-Options: nosniff header is not sent."
        "X-Frame-Options" = "CVE-2022-3260 : `nThe response header has not enabled X-FRAME-OPTIONS, Which helps prevents against Clickjacking attack."
        "X-XSS-Protection" = "CVE-2018-7504 : `nThe X-XSS-Protection response header is not set to block, allowing attempts at reflected cross-site scripting"
        "Content-Security-Policy" = "CVE-2018-5164 : `nContent Security Policy (CSP) is not applied correctly to all parts of multipart content sent with the multipart/x-mixed-replace MIME type"
        
    }

    $missingHeaders = @()
    foreach ($header in $requiredHeaders.GetEnumerator()) {
        if (!$headers.ContainsKey($header.Key)) {
            $missingHeaders += [PSCustomObject]@{
                Header = $header.Key
                CVE = $header.Value
            }
        }
    }
    

    
    return $missingHeaders
    
}

$output = @()
$successCount = 10




# Check if an Apache Version Header was found


function CheckLinuxNginxVersions {
    param (
        [string]$url,
        [ref]$output
    )

    $headers = Invoke-WebRequest -Uri $url | Select-Object -ExpandProperty Headers
    $XPoweredBy = $headers['X-Powered-By']

    # Check if X-Powered-By header exists
    if ($XPoweredBy) {
        Write-Host "Warning: An X-Powered-By header was found. Value: $XPoweredBy" -ForegroundColor Yellow
        $output.Value += "`nWarning: An X-Powered-By header was found. Value: $XPoweredBy. `nRelated vulnerability: `nCWE-200. `nShort Description:The web/application server is leaking information via one or more X-Powered-By HTTP response headers. 
        `nAccess to such information may facilitate attackers identifying other frameworks/components your web application is reliant 
        `nupon and the vulnerabilities such components may be subject to."
         $output.Value+= "`nPossible Solution: `nLocate the nginx config file (usually located at /etc/nginx/nginx.conf) and add `nthe following inside the http { } section: 
         `nserver_tokens and set it to: 
         `nserver_tokens off;  
         `nRestart nginx service to apply changes. "
        $successCount = $successCount - 1
    } else {
        Write-Host "Didn't find any X-Powered-By headers."
        $output.Value += "`nDidn't find any X-Powered-By headers."

    }
}




function CheckInsecureCookies {
    param(
        [string]$url
    )

    $response = Invoke-WebRequest -Uri $url
    $cookies = $response.Headers["Set-Cookie"]

    $insecureCookies = @()
    $cookiesWithoutHttpOnly = @()
    $cookiesWithoutSameSite = @()

    foreach ($cookie in $cookies) {
        if ($cookie -notlike "*Secure*") {
            $cookieName = ($cookie -split ";")[0]
            $insecureCookies += $cookieName
        }

        if ($cookie -notlike "*HttpOnly*") {
            $cookieName = ($cookie -split ";")[0]
            $cookiesWithoutHttpOnly += $cookieName
        }

        if ($cookie -notlike "*SameSite*") {
            $cookieName = ($cookie -split ";")[0]
            $cookiesWithoutSameSite += $cookieName
        }
    }

    $result = @{
        "InsecureCookies" = $insecureCookies
        "CookiesWithoutHttpOnly" = $cookiesWithoutHttpOnly
        "CookiesWithoutSameSite" = $cookiesWithoutSameSite
    }

    return $result
}



function CheckNginxServerHeader {
    param (
        [string]$url
    )

    $response = Invoke-WebRequest -Uri $url -ErrorAction Stop
    if ($response -eq $null) {
        throw "Failed to retrieve headers from $url"
    }

    $headers = $response.Headers
    if ($headers -eq $null) {
        throw "Failed to retrieve headers from the response"
    }

 $serverHeader = $headers["Server"]
    if ($serverHeader -match "nginx/(\d+(\.\d+)*)") {
        $nginxVersion = $Matches[1]
        return $nginxVersion
    } else {
        return $null
    }
}

function CheckTLSVersions {
    param(
        [string]$url
    )

    $request = [System.Net.HttpWebRequest]::Create($url)
    $request.Method = "HEAD"

    try {
        $response = $request.GetResponse()
        $tlsVersion = $response.ProtocolVersion

        if ($tlsVersion -eq "Tls" -or $tlsVersion -eq "Tls11") {
            return $true
        } else {
            return $false
        }
    } catch {
        # In case of an error, assume that TLS 1.0 or TLS 1.1 is not supported.
        return $false
    }
}

function CheckHttpsRedirect {
    param (
        [string]$url
    )

    $response = Invoke-WebRequest -Uri $url -MaximumRedirection 0 -ErrorAction SilentlyContinue
    if ($response -eq $null) {
        return $false
    }

    $statusCode = $response.StatusCode
    if ($statusCode -eq 301 -or $statusCode -eq 302) {
        return $true
    } else {
        return $false
    }
}

$output += "`n++++++++++++++++++++++++++++++++++++++++++++++++++"

# Replace 'http://example.com' with the URL of your app
# Prompt the user for the domain to check
$targetUrl = Read-Host "Domain to check (e.g., example.com)"

$output += "`n`n`nVULNERABILITY REPORT FOR DOMAIN: $targetUrl`n`n`n"

# Add "https://" to the beginning if not provided by the user
if (-not ($targetUrl -like "https://*")) {
    $targetUrl = "https://$targetUrl"
}

# Check if an Apache Version Header was found
$output += "`n++++++++++++++++++++++++++++++++++++++++++++++++++"
$output += "`n`nHTTP to HTTPS Redirect Result:"
$isHttpsRedirect = CheckHttpsRedirect -url $targetUrl
if ($isHttpsRedirect) {
Write-Host    "++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ " -ForegroundColor Green 
    Write-Host "Domain is redirected to HTTPS scheme." -ForegroundColor Green
Write-Host    "++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ " -ForegroundColor Green 
$output += "`nDomain is redirected to HTTPS scheme."

} else {
Write-Host    "------------------------------------------------------------------ " -ForegroundColor Red 
    Write-Host "No HTTPS redirect found! Enforcing HTTP to HTTPS redirection is an essential security practice to ensure secure connections and protect user data from potential eavesdropping or 
    `nman-in-the-middle attacks. Web servers and applications should be configured to automatically redirect HTTP requests to their corresponding HTTPS versions." -ForegroundColor Red
Write-Host    "------------------------------------------------------------------ " -ForegroundColor Red 

$output += "`nNo HTTPS redirect found! `nRealted Vulnerability: Enforcing HTTP to HTTPS redirection is an essential security practice to ensure secure connections and protect user data 
`nfrom potential eavesdropping or man-in-the-middle attacks. Web servers and applications should be configured to automatically redirect HTTP requests to their corresponding HTTPS versions."
 $output +="`nRisk: HIGH."
 $output +="`nPossible Solution: `nGo to your nginx website conf file.
 `nedit it and add the following:
 `nif (`$scheme -eq `"http`") {
      return 301 https://`$server_name`$request_uri;
  }"

$successCount-=1.5
}


$output += "`n----------------------------------------------------------------"
$output += "`nFramework Header Discovery:"
CheckLinuxNginxVersions -url $targetUrl -output ([ref]$output)

$missingHeaders = CheckSecurityHeaders -url $targetUrl
$insecureCookiesResult = CheckInsecureCookies -url $targetUrl
$insecureCookies = $insecureCookiesResult["InsecureCookies"]
$cookiesWithoutHttpOnly = $insecureCookiesResult["CookiesWithoutHttpOnly"]



$output += "`n----------------------------------------------------------------"
$output += "`nMissing Security Headers Result:"


$missingHeaders = CheckSecurityHeaders -url $targetUrl
if ($missingHeaders.Count -gt 0) {
    Write-Host "Missing security headers:"
    
    Write-Host    "++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ " -ForegroundColor DarkYellow
    Write-Host    "++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ " -ForegroundColor DarkYellow 
    $missingHeaders | Format-Table -AutoSize -Property Header, CVE 
    $successCount = $successCount-3
   Write-Host     "++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ " -ForegroundColor DarkYellow
    Write-Host    "++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ " -ForegroundColor DarkYellow 

    $headers = $missingHeaders | ForEach-Object { $_.Header }
    $cves = $missingHeaders | ForEach-Object { $_.CVE }
    $output += "`nMissing security headers: `n$($headers -join ', ')`nRelated CVE's: `n$($cves -join ', ')`n"
     $output +="`nRisk: HIGH."
     $output += "`nPossible Solution: `nGo to your nginx website conf file, and add the desired header name and its value `n
     inside the server { } section. for example:
     `nserver{
     `nadd_header X-Frame-Options `"SAMEORIGIN`"
     `n}
     `nThen reload or restart nginx service."
  
} else {
    Write-Host "All required security headers are present." -ForegroundColor Green 
    $output += "`nAll required security headers are present."
 
}

# Check if an Apache Version Header was found
$output += "`n----------------------------------------------------------------"
$output += "`nInsecure Cookies Check:"


if ($insecureCookies.Count -gt 0) {

    Write-Host    "------------------------------------------------------------------ " 
    Write-Host "Insecure cookies found:"
    $insecureCookies | ForEach-Object { Write-Host "  $_" -ForegroundColor Red } 
    $successCount--
    Write-Host    "------------------------------------------------------------------ " 
    $output += "`nInsecure cookies found: $insecureCookies"
    $output +="`nInsecure cookies can lead to various security risks, including session hijacking, cross-site scripting (XSS) attacks, and man-in-the-middle attacks."
    $output +="`nRisk: Medium."
    
} else {
Write-Host    "+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ "
    Write-Host "No Insecured cookies found." -ForegroundColor Green 
Write-Host    "+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ "
    $output += "`nNo Insecured cookies found."
    
}

if ($cookiesWithoutHttpOnly.Count -gt 0) {
    Write-Host    "------------------------------------------------------------------ "
    Write-Host "Cookies without HttpOnly attribute found:"
   $successCount = $successCount-0.5
    $cookiesWithoutHttpOnly | ForEach-Object { Write-Host "  $_" -ForegroundColor Red }
    Write-Host    "------------------------------------------------------------------ "

    $output += "`nCookies without HttpOnly attribute found: $cookiesWithoutHttpOnly "
    $output += "`nVulnerability Description:Not using the HttpOnly attribute may lead to client-side scripts to access cookies, increasing the risk of XSS attacks"
    $output += "`nRisk: MEDIUM"
 
} else {
Write-Host    "+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ "
    Write-Host "Did not find and cookies without HttpOnly attribute." -ForegroundColor Green 
Write-Host    "+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ "

           $output += "`nDid not find and cookies without HttpOnly attribute."
   
}

if ($cookiesWithoutSameSite.Count -gt 0) {
    Write-Host    "------------------------------------------------------------------ "
    Write-Host "Cookies without SameSite attribute found:"
   
    $cookiesWithoutHttpOnly | ForEach-Object { Write-Host "  $_" -ForegroundColor Red }
    Write-Host    "------------------------------------------------------------------ "
   $successCount = $successCount-0.5
   $output += "`nCookies without HttpOnly attribute found: $cookiesWithoutSameSite "
    $output += "`nThe SameSite attribute is a relatively new feature in web browsers that helps control how cookies are sent in cross-origin requests.
    `nNot using the SameSite attribute for cookies can introduce security risks, particularly related to Cross-Site Request Forgery (CSRF) attacks and user privacy. "
    $output += "`nRisk: MEDIUM"
} else {
Write-Host    "+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ "
    Write-Host "Did not find and cookies without SameSite attribute." -ForegroundColor Green 
Write-Host    "+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ "
$output += "`nDid not find and cookies without SameSite attribute."
}



# Check if an Apache Version Header was found
$output += "`n----------------------------------------------------------------"
$output += "`nWeb Server Version Check:"


$nginxVersion = CheckNginxServerHeader -url $targetUrl
if ($nginxVersion) {
    Write-Host "------------------------------------------------------------------ "
    Write-Host "`nnginx Version Header Found: $nginxVersion."  -ForegroundColor Red 
    Write-Host "Risk: MEDIUM"
    Write-Host "`nPossible Solution: `nLocate the nginx config file (usually located at /etc/nginx/nginx.conf) and add `nthe following inside the http { } section: 
         `nserver_tokens and set it to: 
         `nserver_tokens off;  
         `nRestart nginx service to apply changes. "
    $successCount--
    Write-Host "------------------------------------------------------------------ "
    $output += "`nnginx Version Header Found: $nginxVersion." 
      $output += "`nRISK: MEDIUM"
      $output += "`nPossible Solution: `nLocate the nginx config file (usually located at /etc/nginx/nginx.conf) and add `nthe following inside the http { } section: 
         `nserver_tokens and set it to: 
         `nserver_tokens off;  
         `nRestart nginx service to apply changes. "
}
else {
    Write-Host "+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ " 
    Write-Host "No Nginx Version Header Was Found." -ForegroundColor Green
    Write-Host "+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ " 


    $output += "`nNo Nginx Version Header Was Found." 
  
}

$output += "`n----------------------------------------------------------------"
$output += "`n`nTLS Version Check:"

$insecureTLS = CheckTLSVersions -url $targetUrl
if ($insecureTLS) {
 Write-Host    "------------------------------------------------------------------ " 
    Write-Host "`nWarning: Insecure TLS version (TLS 1.0 or TLS 1.1) is supported by the domain SSL certificate. Consider using a higher TLS supported certificate." -ForegroundColor -ForegroundColor DarkYellow
 Write-Host    "------------------------------------------------------------------ " 
 $output += "`nWarning: Insecure TLS version (TLS 1.0 or TLS 1.1) is supported by the domain SSL certificate. Consider using a higher TLS supported certificate."
 $successCount = $successCount-1
  $output +="`nRisk: HIGH."
}
else{
Write-Host    "+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ " 
  Write-Host "`nNo 1.1 or 1.0 TLS versions found on target domain: " $targetUrl -ForegroundColor Green
Write-Host    "+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ " 
    $output += "`nNo 1.1 or 1.0 TLS versions found on target domain: $targetUrl " 
    
}
$output += "`n----------------------------------------------------------------"
$output += "`n`nAfter Everything Checked, this is the following calculted score:"

# Check if all checks were successful (all results are green)
if ($successCount -eq 10) {
    Write-Host "Total result score: 10/10" -ForegroundColor Green
    $output += "`n`n`nTotal result score: $successCount/10"
} elseif ($successCount -gt 6) {
    Write-Host "Total result score: $successCount/10" -ForegroundColor DarkYellow
    $output += "`n`n`nTotal result score: $successCount/10"
} else {
    Write-Host "Total result score: $successCount/10" -ForegroundColor Red
    $output += "`n`n`nTotal result score: $successCount/10"
}
$output += "`n----------------------------------------------------------------"


function ConvertTo-PDF {
    param (
        [string]$Source,
        [string]$Destination
    )

    try {
        $word = New-Object -ComObject Word.Application
        $word.Visible = $false
        $doc = $word.Documents.Open($Source)
        $doc.SaveAs([ref]$Destination, [ref]17)
        $doc.Close()
        $word.Quit()

        Write-Host "PDF created: $Destination" -ForegroundColor Green
    }
    catch {
        Write-Host "Failed to create PDF: $_" -ForegroundColor Red
    }
}

# Prompt the user to export a PDF results file
$exportToPdf = Read-Host "Would you like to export a PDF results file (y/n)?"
if ($exportToPdf -eq "y" -or $exportToPdf -eq "Y") {
# Save the output to a text file
$outputFilePath = "$env:TEMP\script_output.txt"
$output | Out-File -FilePath $outputFilePath -Encoding UTF8

# Convert the text file to PDF
$pdfFilePath = Read-Host "Enter the PDF file path to save the results (e.g., C:\Path\To\Results.pdf)"
ConvertTo-PDF -Source $outputFilePath -Destination $pdfFilePath
}


else {
    Write-Host "Done checking."
}