vuln-headers-extension

---

This is firefox extension which parses the requests before forwarding to the DNS server to scan for vulnerable URLs which occur due to Headers.

Highlights

---

The extension currently detects URLs which are vulnerable to

• CORS Misconfiguration
• Host Header Injection
• Missing X-XSS-Protection headers (commented in the code due to its low severity)
• Clickjacking support

Achievements

---

Submitted vulnerabilities to websites like #signup.com , #Chargify, #Hotstar, #Medium, etc using this tool. Got listed in #Chargify HOF and other organisaitons are resolving the issues.

Screenshots

Installation

---

Method 1 -

1. Clone the repo or fork it.
2. Open Firefox and load about:debugging in the URL bar.
3. Click the Load Temporary Add-on button and select the manifest.json file in your cloned repo.
4. Now the vuln-headers-extension is installed.

Method 2 -

1. Clone the repo or fork it.
2. Install the web-ext tool, a npm package.
3. Change into the directory where you cloned the repo.
4. Type web-ext run. This will launch Firefox and install the extension.

Using -

1. Once you install the extension you can see an icon in the tool bar.
2. Click on the icon and a new tab gets opened.
3. Leave it open and do your browsing/work.
4. The extension automatically logs all the vulnerable URLs to the new tab.
5. Now you can submit a report to the respective organisaiton and make it more secure.

Contributing

Want to add more features to it? Fork the repo and create a Pull Request. Like this tool, STAR it and click on Watch to get more updates on this tool.

Article

https://medium.com/@rewanthcool/firefox-vuln-headers-extension-e848b6d80d14