Security Headers and SSL/TLS
There are several other specialty websites
that we can use to gather information
about a website or domain’s security posture.
Some of these sites blur the line
between passive and active information gathering,
but the key point for our purposes
is that a third-party is initiating any scans or checks.
One such site is Security Headers,
which will analyze HTTP response headers
and provide basic analysis of the target site’s security posture.
We can use this to get an idea of an organization’s coding
and security practices based on the results.
Let’s scan www.megacorpone.com and check the results.
The site is missing several defensive headers.
These missing headers
are not necessarily vulnerabilities in and of themselves,
but they could indicate web developers
or server admins that are not familiar with server hardening.
Another scanning tool we can use is the SSL Server Test from Qualys SSL Labs.
This tool analyzes a server’s SSL/TLS configuration
and compares it against current best practices.
It will also identify some vulnerabilities,
such as Poodle or Heartbleed.
Let’s scan www.megacorpone.com and check the results.
The results seem better than the Security Headers check.
However, this shows that the server supports TLS versions such as 1.0 and 1.1,
which implement insecure cipher suites.
This ultimately suggests that our target
is not applying current best practices for SSL/TLS hardening.
We can use these findings to gain insights about the security practices,
or lack thereof, within the target organization.