wstg-conf-07

name	wstg-conf-07
description	Test HTTP Strict Transport Security
category	configuration
owasp_id	WSTG-CONF-07
version	1.0.0
author	cyberstrike-official
tags	["misconfiguration","hardening","server","wstg","conf"]
tech_stack	[]
cwe_ids	["CWE-200"]
chains_with	[]
prerequisites	[]
severity_boost	{}

wstg-conf-07

Test ID

WSTG-CONF-07

Test Name

Test HTTP Strict Transport Security (HSTS)

High-Level Description

HTTP Strict Transport Security (HSTS) is a security mechanism that forces browsers to communicate with websites only over HTTPS. When properly implemented, HSTS protects against protocol downgrade attacks, SSL stripping, and cookie hijacking. This test verifies that the HSTS header is present, properly configured, and includes appropriate directives.

---

What to Check

HSTS Header Directives

Directive	Description	Recommended
max-age	Time in seconds to enforce HTTPS	>= 31536000 (1 year)
includeSubDomains	Apply HSTS to all subdomains	Yes
preload	Include in browser preload lists	Recommended

Verification Points

• HSTS header present on HTTPS responses
• max-age value is sufficiently long
• includeSubDomains directive present
• preload directive present (optional)
• Header not sent over HTTP
• All subdomains support HTTPS (if includeSubDomains)

---

How to Test

Step 1: Check HSTS Header

# Check for HSTS header
curl -sI https://target.com | grep -i strict-transport-security

# Full header analysis
curl -sI https://target.com | grep -iE 'strict-transport|content-security|x-frame|x-content'

# Check specific values
curl -sI https://target.com | grep -i strict-transport-security | \
    grep -oP 'max-age=\d+'

Step 2: Verify Header Values

#!/bin/bash
TARGET=$1

echo 
 


hsts=$(curl -sI  | grep -i  |  -d )

 [ -z  ]; 
     
     1


 


max_age=$(  | grep -oP )
 [ -z  ]; 
     
 [  -lt 31536000 ]; 
     

     



   | grep -qi ; 
     

     



   | grep -qi ;