import requests
from urllib.parse import urlparse
import re
class ChannelSecurityTester:
def __init__(self, domain):
self.domain = domain
self.findings = []
def test_http_redirect(self):
"""Test if HTTP redirects to HTTPS"""
print("[*] Testing HTTP redirect...")
try:
response = requests.get(
f"http://{self.domain}",
allow_redirects=False,
timeout=10
)
if response.status_code in [301, 302, 307, 308]:
location = response.headers.get('Location', '')
if location.startswith('https://'):
print(f"[OK] Redirects to HTTPS: {location}")
return
else:
print(f"[WARN] Redirects but not to HTTPS: {location}")
print("[VULN] HTTP accessible without redirect to HTTPS")
self.findings.append({
"issue": "HTTP accessible without HTTPS redirect",
"severity": "High"
})
except requests.exceptions.ConnectionError:
print("[OK] HTTP not accessible (port closed)")
def test_hsts(self):
"""Test HSTS implementation"""
print("\n[*] Testing HSTS...")
try:
response = requests.get(f"https://{self.domain}", timeout=10)
hsts = response.headers.get('Strict-Transport-Security', '')
if hsts:
print(f"[OK] HSTS: {hsts}")
if 'max-age=' in hsts:
max_age = int(re.search(r'max-age=(\d+)', hsts).group(1))
if max_age < 31536000:
print("[WARN] HSTS max-age less than 1 year")
self.findings.append({
"issue": "HSTS max-age too short",
"severity": "Low"
})
else:
print("[VULN] HSTS header missing")
self.findings.append({
"issue": "Missing HSTS header",
"severity": "Medium"
})
except Exception as e:
print(f"[ERROR] {e}")
def test_mixed_content(self, pages):
"""Test for mixed content on HTTPS pages"""
print("\n[*] Testing for mixed content...")
http_resources = []
for page in pages:
try:
response = requests.get(f"https://{self.domain}{page}", timeout=10)
http_refs = re.findall(r'(?:src|href|action)=["\']http://[^"\']+["\']',
response.text, re.IGNORECASE)
for ref in http_refs:
print(f"[VULN] Mixed content on {page}: {ref[:60]}")
http_resources.append({'page': page, 'resource': ref})
except Exception as e:
pass
if http_resources:
self.findings.append({
"issue": f"Mixed content found ({len(http_resources)} resources)",
"severity": "Medium"
})
def test_sensitive_forms(self, form_pages):
"""Test if sensitive forms submit securely"""
print("\n[*] Testing form security...")
for page in form_pages:
try:
response = requests.get(f"https://{self.domain}{page}", timeout=10)
forms = re.findall(r'<form[^>]*action=["\']([^"\']*)["\']',
response.text, re.IGNORECASE)
for action in forms:
if action.startswith('http://'):
print(f"[VULN] Form on {page} submits to HTTP: {action}")
self.findings.append({
"issue": f"Form submits to HTTP on {page}",
"severity": "High"
})
except Exception as e:
pass
def generate_report(self):
"""Generate security report"""
print("\n" + "="*50)
print("CHANNEL SECURITY REPORT")
print("="*50)
if not self.findings:
print("\nNo issues found.")
return
print(f"\nFindings: {len(self.findings)}")
for f in self.findings:
print(f"\n [{f['severity']}] {f['issue']}")
tester = ChannelSecurityTester("target.com")
tester.test_http_redirect()
tester.test_hsts()
tester.test_mixed_content(["/", "/login", "/dashboard"])
tester.test_sensitive_forms(["/login", "/register", "/payment"])
tester.generate_report()
