Vapt Headers

Infrastructure & Security Headers

When Invoked

The user runs /vapt headers <url> or this skill is triggered as part of Wave 1 during /vapt audit.

Phase 1: Header Collection

1.1 Fetch Response Headers

curl -sIL <url>

Also check specific paths:

curl -sI <url>/login 2>/dev/null
curl -sI <url>/api 2>/dev/null
curl -sI <url>/admin 2>/dev/null

1.2 Extract All Security-Relevant Headers

Parse the response for each of these headers (case-insensitive):

Security Headers:

• Content-Security-Policy
• X-Frame-Options
• X-Content-Type-Options
• Strict-Transport-Security
• Referrer-Policy
• Permissions-Policy
• X-XSS-Protection
• Cross-Origin-Opener-Policy
• Cross-Origin-Resource-Policy
• Cross-Origin-Embedder-Policy

CORS Headers:

• Access-Control-Allow-Origin
• Access-Control-Allow-Methods
• Access-Control-Allow-Headers
• Access-Control-Allow-Credentials

Information Disclosure:

• Server
• X-Powered-By
• X-AspNet-Version
• X-AspNetMvc-Version
• X-Generator

Cache Headers (on sensitive pages):

• Cache-Control
• Pragma
• Expires

Phase 2: Header Analysis

2.1 Content-Security-Policy (CSP)

2.2 X-Frame-Options / frame-ancestors

2.3 HSTS

2.4 Other Security Headers

2.5 CORS Analysis

Test CORS by sending request with crafted Origin:

curl -sI -H "Origin: https://evil.com" <url> | grep -i access-control

2.6 Information Disclosure

2.7 HTTP Methods

curl -sI -X OPTIONS <url> | grep -i allow

Check if dangerous methods are enabled:

• TRACE — can enable Cross-Site Tracing (XST)
• PUT / DELETE — on static content paths
• CONNECT — proxy abuse

2.8 Cookie Security

curl -sI <url> | grep -i set-cookie

For each cookie, check:

2.9 Cache-Control on Sensitive Pages

Check login pages, account pages, API responses for:

• Cache-Control: no-store (sensitive data should not be cached)
• Pragma: no-cache (for HTTP/1.0 compatibility)

Phase 3: Output

Terminal Output

Display a header scorecard:

Dev mode: Explain each header's purpose, show what a properly configured header looks like, provide copy-paste nginx/Apache config.

Pro mode: Pass/fail table only.

VAPT-HEADERS.md

# VAPT Security Headers Analysis

## Target: <url>
## Date: <timestamp>

## Header Scorecard

| Header | Status | Value | Severity |
|--------|--------|-------|----------|
| Content-Security-Policy | ... | ... | ... |
| X-Frame-Options | ... | ... | ... |
| X-Content-Type-Options | ... | ... | ... |
| Strict-Transport-Security | ... | ... | ... |
| Referrer-Policy | ... | ... | ... |
| Permissions-Policy | ... | ... | ... |

## CORS Configuration
<analysis results>

## Information Disclosure
<server/version headers found>

## Cookie Security
| Cookie | HttpOnly | Secure | SameSite | Path |
|--------|----------|--------|----------|------|
| ... | ... | ... | ... | ... |

## HTTP Methods
<allowed methods per endpoint>

## Findings
<scored findings table>

## Recommended Configuration

### Nginx
<copy-paste header config>

### Apache
<copy-paste header config>

## Suggested Next Steps
- /vapt ssl <url> — analyze SSL/TLS configuration
- /vapt scan <url> — check for web application vulnerabilities

Cross-Skill Integration

• Security header findings feed into Wave 1 context
• CSP analysis informs XSS testing strategy in vapt-inject (weak CSP = higher XSS impact)
• CORS findings inform vapt-api cross-origin testing