Identify and automate custom tests against your attack surface

# Only web ports should be exposed

def scan_module(ip, port, domain, info):
    web_ports = [80, 443]

    if port not in web_ports:
        return False

    return True
          

# Only bastion hosts should expose SSH

def scan_module(ip, port, domain, info):
    allowed_hosts = [
        'bastion1.example.com',
        'bastion2.example.com'
    ]

    if port == 22 or 'ssh' in info.lower():
        if domain not in allowed_hosts:
            return False

    return True
          

# /admin should return 401
import requests

def scan_module(ip, port, domain, info):
    status = requests.get(
        'https://' + domain + '/admin', timeout=2
    ).status_code

    if status != 401:
        print(f"Domain {domain} returned status {status}")
        return False

    return True
          

# Validate CSP
import requests

def scan_module(ip, port, domain, info):
    r = requests.get(
        'https://' + domain + '/admin', timeout=2
    )

    csp = r.headers.get('Content-Security-Policy')

    if not csp:
        return False

    desired_script_src = "script-src strict-dynamic 'unsafe-inline' http: https: 'self' 'nonce-"

    return desired_script_src in csp