scan for non-secure contents on https pages

khuongdp · 09-19-2014, 08:37 AM

Anybody know some script/tools to scan a specific https page for non-secure contents. Should be called from command line. Good thing if it support recursive.

vmccord · 09-19-2014, 10:56 AM

In what context? Pages that you serve or pages that are being served to you?

Habitual · 09-19-2014, 01:30 PM

https://www.rfxn.com/lmd-1-4-1-deliv...your-requests/ for 'local' content?

khuongdp · 09-19-2014, 03:22 PM

Before our site is sent to production we want to verify the site does not contains non-secure contents when running in https. The script/tools should be run by our monitoring tools (Sensu) which will execute the script i.e. every minute. Something like nagios plugin for check_http i.e.

check_non-secure_contents.sh -h https://somesite.com -w 1 -c 2

jefro · 09-19-2014, 07:58 PM

Don't browsers warn of potential issues on a https page?

unSpawn · 09-20-2014, 12:51 PM

A Nagios plugin for this doesn't exist as far as I know. I'd say use a spider, could even 'wget' recursively, then grep stored files for any 'http://' strings?..

khuongdp · 09-21-2014, 02:26 PM

Quote:

Originally Posted by jefro

Don't browsers warn of potential issues on a https page?

Yes it does. But I need a automatic way to check the site and response back to me when the site does contains non-secure contens. I don't want to open a browsers 100 times at day and with recursive pages it will be a nightmare

khuongdp · 09-21-2014, 02:33 PM

Quote:

Originally Posted by unSpawn

A Nagios plugin for this doesn't exist as far as I know. I'd say use a spider, could even 'wget' recursively, then grep stored files for any 'http://' strings?..

It looks like the best solution right now. Using the --spider option for wget.

vmccord · 09-22-2014, 01:52 PM

Not to make it more complicated, but grepping for 'http://' isn't enough because one can serve (not that one should) embedded content without necessarily specifying the protocol. For example an iframe src='domain.com/some-content.html'.

khuongdp · 09-22-2014, 03:31 PM

Quote:

Originally Posted by vmccord

Not to make it more complicated, but grepping for 'http://' isn't enough because one can serve (not that one should) embedded content without necessarily specifying the protocol. For example an iframe src='domain.com/some-content.html'.

You are right. Is it possible to starting a firefox/chrome session with an url as argument and then somehow extract the console information about non-secure contents?