SecurityTxtToolkit

DOWNLOAD IT!

Install-Module SecurityTxtToolkit

SHORT DESCRIPTION

SecurityTxtToolkit is a module that works with "security.txt" files, as defined in RFC 9116.

LONG DESCRIPTION

SecurityTxtToolkit is a PowerShell module. It can create, download, test, and verify "security.txt" files.

"security.txt" is an RFC for letting web sites post and share information pertinent to security researchers. This module currently complies with draft version 12.

Testing "security.txt" Files with `Test-SecurityTxtFile`

To test a "security.txt" file, use the cmdlet Test-SecurityTxtFile. It can be used in both online and offline modes. It outputs a PSCustomObject that has note-properties corresponding to the fields in the "security.txt" file:

PS C:\> Test-SecurityTxtFile 'github.com'

As of this writing (June 2021), that will generate the following output:

Test-SecurityTxtFile: The mandatory Expires field was not found.

For                : github.com
IsValid            : False
IsCanonical        : True
Acknowledgements   : {https://bounty.github.com/bounty-hunters.html}
Canonical          : {https://github.com/.well-known/security.txt}
Contact            : {https://hackerone.com/github}
Encryption         : {}
Expires            :
Hiring             : {}
Policy             : {https://bounty.github.com/}
PreferredLanguages : {en}
IsSigned           : False

It looks like GitHub's "security.txt" file is not compliant with the specification (at the time of this writing)!

The Test-SecurityTxtFile cmdlet also accepts string input via -InputObject or the pipeline:

PS C:\> Get-Content "security.txt" | Test-SecurityTxtFile

That will test the file and validate its input:

For                : stdin
IsValid            : False
IsCanonical        : False
Acknowledgements   : {https://bounty.github.com/bounty-hunters.html}
Canonical          : {https://github.com/.well-known/security.txt}
Contact            : {https://hackerone.com/github}
Encryption         : {}
Expires            :
Hiring             : {}
Policy             : {https://bounty.github.com/}
PreferredLanguages : {en}
IsSigned           : False

However, that cannot be validated for canonicity. In this case, you can add the file's original URL to the cmdlet with the -TestCanonicalUri parameter:

PS C:\> Invoke-WebRequest -OutFile 'security.txt' -Uri 'https://github.com/.well-known/security.txt'

PS C:\> Get-Content 'security.txt' | Test-SecurityTxtFile -TestCanonicalUri 'https://github.com/.well-known/security.txt'

The latter command will parse the previously-downloaded "security.txt" file as if it had been fetched directly from a web server:

For                : stdin
IsValid            : False
IsCanonical        : True
Acknowledgements   : {https://bounty.github.com/bounty-hunters.html}
Canonical          : {https://github.com/.well-known/security.txt}
Contact            : {https://hackerone.com/github}
Encryption         : {}
Expires            :
Hiring             : {}
Policy             : {https://bounty.github.com/}
PreferredLanguages : {en}
IsSigned           : False

Generating Your Own "security.txt" Files

The New-SecurityTxtFile cmdlet will generate a "security.txt" file, sending its output to the pipeline. You may redirect it via standard means, or with the -OutFile parameter. The fields in the "security.txt" specification correspond to this cmdlet's parameters.

PS C:\> New-SecurityTxtFile -OutFile '.well-known/security.txt' -Canonical "https://contoso.com/.well-known/security.txt" -Contact "mailto:[email protected]" -Hiring "https://jobs.contoso.com"

That example will genereate the following output. The Expires field and PGP signature will vary:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

# This is a "security.txt" file that complies with RFC 9116:
# <https://www.rfc-editor.org/rfc/rfc9116>
#
# This file was made with SecurityTxtToolkit:
# <https://github.com/rhymeswithmogul/SecurityTxtToolkit>

Canonical: https://contoso.com/.well-known/security.txt
Contact: mailto:[email protected]
Expires: 2022-06-18T16:41:06-04:00
Hiring: https://jobs.contoso.com/

-----BEGIN PGP SIGNATURE-----

signature-goes-here
-----END PGP SIGNATURE-----

[GNUPG:] NEWSIG
gpg: Signatur vom 12.05.2023 10:20:19 Mitteleurop�ische Sommerzeit
gpg:                mittels EDDSA-Schlüssel 50E6EA9B7AFD2553457C77C8A7F4B35E85BB2BAA
[GNUPG:] KEY_CONSIDERED 50E6EA9B7AFD2553457C77C8A7F4B35E85BB2BAA 0
[GNUPG:] SIG_ID J9x1yaxahXcGXBiOAfw+N7a0VxI 2023-05-12 1683879619
[GNUPG:] KEY_CONSIDERED 50E6EA9B7AFD2553457C77C8A7F4B35E85BB2BAA 0
[GNUPG:] GOODSIG A7F4B35E85BB2BAA IT Sicherheit Johann Wolfgang Goethe-Universit├ñt Frankfurt <[email protected]>
gpg: Korrekte Signatur von "IT Sicherheit Johann Wolfgang Goethe-Universität Frankfurt <[email protected]>" [ultimativ]
[GNUPG:] VALIDSIG 50E6EA9B7AFD2553457C77C8A7F4B35E85BB2BAA 2023-05-12 1683879619 0 4 0 22 10 01 50E6EA9B7AFD2553457C77C8A7F4B35E85BB2BAA
[GNUPG:] TRUST_ULTIMATE 0 pgp

See all parts starting with [GNUPG]

I'd be open to write a PR if you're interested.

Thank you for this nifty tool nevertheless :)

rhymeswithmogul / securitytxttoolkit Goto Github PK