Web Security Audit

The goal of this project is to build an add-on for browser that passively audits the security posture of the websites that the user is visiting. Assume that the tool is to be used on non-malicious websites, currently not under attack or compromised. Add-on wants to report security misconfigurations, or failure to use best security practices.

- Add-on tries to analysis the commonly vulnerable setting of servers: lack of use of security-relevant headers, including:
* strict-transport-security
* x-xss-protection
* content-security-policy
* x-frame-options
* x-content-type-options

- It doesn't to interfere with the functioning of the visited website.
- It doesn't tamper with request parameters, or issue requests that were not initiated by the user (it is not active scanning).
- Incrementally generate a report in a separate window.
- Each report entry have a numeric score to indicate approximately its severity, as a way to prioritise further investigation by a human analyst [Common Vulnerability Scoring System](https://en.wikipedia.org/wiki/Common_Vulnerability_Scoring_System).

### Limitations
- Add-on only works on sites that allow content scripts.

Permissions

Web Security Audit

par ulmdesign

Saisies d'écran

À propos de l'extension

Rétroaction des usagers

Saisies d'écran

À propos de l'extension

Related

uBlock Origin

History Cleaner (History Eraser)

4b42 GeoIP

LastPass

Proxy Switcher & Manager