Add New Module: HTTP Security Headers Detection #1178
Description
Feature Request: Add HTTP Security Headers Detection Module
I would like to propose adding a small new module to Nettacker that checks for common web security headers. Missing headers are a frequent security misconfiguration and are easy to detect with a lightweight HTTP check.
Proposed Behavior
For each target URL:
- Send a simple HTTP GET request
- Check for the presence of important security headers:
- Strict-Transport-Security
- X-Frame-Options
- Content-Security-Policy
- X-Content-Type-Options
- Referrer-Policy
- Permissions-Policy
- Report which headers are missing or misconfigured
Output Example
The module would return:
- target URL
- header name
- present/missing
- details if applicable
Why This Helps
- Very common security issue
- Complements existing HTTP modules
- Quick to scan and lightweight
- Useful for automation and baseline security checks
Implementation Plan
If the maintainers approve, I can work on:
- Creating the module under
modules/ - Writing the core header-detection logic
- Integrating with Nettacker reporting format
- Adding simple unit tests
- Updating documentation
Please let me know if this would be a valuable addition. I would be happy to implement it.