Created
August 23, 2018 18:18
-
-
Save 0xbadjuju/d69261e11afb0ac0f79f220db1c54987 to your computer and use it in GitHub Desktop.
Checks if the X-Frame-Options header is present
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
add-type @" | |
using System.Net; | |
using System.Security.Cryptography.X509Certificates; | |
public class TrustAllCertsPolicy : ICertificatePolicy { | |
public bool CheckValidationResult( | |
ServicePoint srvPoint, X509Certificate certificate, | |
WebRequest request, int certificateProblem) { | |
return true; | |
} | |
} | |
"@ | |
[System.Net.ServicePointManager]::CertificatePolicy = New-Object TrustAllCertsPolicy | |
[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12 | |
function Check-XFrameOptions | |
{ | |
[CmdletBinding()] | |
Param( | |
[Parameter(Mandatory = $true, | |
HelpMessage = 'Input file.')] | |
[string]$file | |
) | |
$lines = Get-Content $file | |
foreach ($line in $lines) | |
{ | |
$uri = "http://$line/" | |
if ($line.Contains("443")) | |
{ | |
$uri = "https://$line/" | |
} | |
try | |
{ | |
$request = Invoke-WebRequest -Uri $uri | |
} | |
catch | |
{ | |
if (!$request.StatusCode -eq [System.Net.HttpStatusCode]::NotFound) | |
{ | |
Write-Host -ForegroundColor Red "$line - Connect" | |
Out-File -Append "${file}_connect.txt" -InputObject $line | |
continue | |
} | |
} | |
$title = $($request.ParsedHtml.getElementsByTagName('title')).innertext; | |
if($request.Headers.ContainsKey("X-Frame-Options")) | |
{ | |
Write-Host -ForegroundColor Red "$line - False Positive" | |
Out-File -Append "${file}_falsepositive.txt" -InputObject "$line`tFalse Positive" | |
} | |
else | |
{ | |
Write-Host -ForegroundColor Green "$line - Verified $title" | |
Out-File -Append "${file}_verified.txt" -InputObject "$line`tVerified`t$title" | |
} | |
} | |
} |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment