HTTP Security Assessment

Automated vulnerability detection and security analysis for web applications

Introduction

The HTTP Security Assessment system is the framework's automated vulnerability detection capability that performs deep security analysis of web applications and APIs. It captures complete HTTP transactions, analyzes security headers ?, validates SSL/TLS certificates ?, assesses cookie security, measures performance, and generates comprehensive diagnostic reports.

Key Capabilities

• 35+ Security Checks - Headers, SSL, cookies, CORS, CSP analysis
• Automated Detection - HSTS, XSS protection, clickjacking vulnerabilities
• Performance Profiling - Response times, compression, caching metrics
• Compliance Analysis - PCI-DSS, GDPR, OWASP alignment
• mAi Advisor™ Integration - Actionable, role-specific guidance
• 18 Report Configurations v2.2.0 - 3 depth levels × 6 audience types
• HTML Reports with Help Links v3.0.0 - Dual MD+HTML output with Perplexity.ai

Architecture Components

The HTTP assessment system consists of 6 core components:

Analysis Phases

1. Network & Geolocation
2. TLS & Certificate validation
3. Security header analysis
4. Cookie security assessment
5. Redirect chain inspection
6. Performance profiling
7. Compliance checking

Report Configuration NEW v2.2.0

The reporting system offers 18 different report configurations through two independent controls.

Report Depth Levels

Audience Configuration

What Gets Audited

Security Headers (12 Types)

Critical: Strict-Transport-Security (HSTS), Content-Security-Policy (CSP), X-Frame-Options, X-Content-Type-Options

Important: X-XSS-Protection, Referrer-Policy, Permissions-Policy, Cross-Origin-* (CORS)

SSL/TLS Configuration

• Certificate chain integrity and expiration
• TLS protocol version (1.2, 1.3)
• Cipher suite strength
• Self-signed certificate detection

Cookie Security

• Secure flag - HTTPS-only transmission
• HttpOnly flag - JavaScript access prevention
• SameSite policy - CSRF protection

Performance Metrics

Compliance Checking

Standards analyzed: OWASP Top 10 ?, PCI-DSS ?, GDPR ?, NIST TLS standards.

Running HTTP Audits

Using Test Suite (Recommended)

@Test
@Tag("audit")
@DisplayName("TC - Audit - HttpReview - www.saucedemo.com")
public void tc_audit_httpreview_www_saucedemo_com() {
    String url = "https://www.saucedemo.com/v1/";
    FW_CustomAssertJU.autoPass(
        FW_AuditManager.INSTANCE.getAuditHttpReview()
            .runAuditHttpReview(url, true)
    );
}

Using FW_AuditManager API

// Simple audit (default: STANDARD depth, DEVELOPER audience)
FW_AuditManager.INSTANCE.performHttpAudit("https://example.com");

// With verbose output
FW_Http http = FW_AuditManager.INSTANCE.performHttpAudit(
    "https://example.com", 
    true  // verbose console output
);

// Access results
System.out.println("Security Score: " + http.getSecurityScore());
System.out.println("Critical Findings: " + http.getCriticalFindingsCount());

Configuring Report Depth and Audience

FW_Http http = FW_AuditManager.INSTANCE.performHttpAudit(url, false);
FW_HttpReporter reporter = new FW_HttpReporter();

// Configure depth and audience
reporter.setReportDepth(FW_HttpReporter.ReportDepth.EXECUTIVE);
reporter.setTargetAudience(FW_AdvisorAudience.EXECUTIVE);

// Generate report
String report = reporter.generateReport(http);

// Save to file
Files.write(
    Paths.get("target/http-reports/executive-summary.md"),
    report.getBytes(StandardCharsets.UTF_8)
);

Common Report Configurations

Understanding Reports

Color-Coded Findings

• 🔴 Red (Critical) - Immediate action required
• 🟠 Orange (High) - Address within 1 week
• 🟡 Yellow (Medium) - Address within 1 month
• 🔵 Blue (Low) - Address when convenient
• ⚪ White (Info) - Informational only

Configuration Options

Configure audit behavior in testConfig.properties:

# HTTP Audit Configuration
http.followRedirects=true
http.maxRedirects=10
http.connectionTimeout=30000
http.readTimeout=60000
http.userAgent=Mozilla/5.0 (MissionWares Audit Bot)

# Report Generation
http.generateHtmlReport=true
http.generateMarkdownReport=true
http.reportOutputPath=target/http-reports/

# Report Configuration (NEW in v2.2.0)
http.report.defaultDepth=STANDARD
http.report.defaultAudience=DEVELOPER

# mAi Advisor™ Integration
advisorEnabled=true
advisorDefaultAudience=DEVELOPER
advisorIncludeCodeExamples=true

Troubleshooting

Debugging Techniques

// Enable verbose output
FW_Http http = FW_AuditManager.INSTANCE.performHttpAudit(url, true);

// Check FW_Http Object
System.out.println("Valid: " + http.isValid());
System.out.println("Complete: " + http.isResponseComplete());
System.out.println("Has Error: " + http.hasError());

// Verify report configuration
System.out.println("Depth: " + reporter.getReportDepth());
System.out.println("Audience: " + reporter.getTargetAudience());

Best Practices

Choose Depth Based on Purpose

• EXECUTIVE - Daily standups, quick status checks, leadership briefings
• STANDARD - Sprint reviews, technical discussions, team meetings
• COMPREHENSIVE - Debugging, forensics, compliance documentation

Choose Audience Based on Reader

• DEVELOPER - Implementers who write code
• SECURITY_ENGINEER - Security specialists who assess threats
• PROJECT_MANAGER - Coordinators who plan work
• EXECUTIVE - Leaders who need business context
• OPS_INFRASTRUCTURE - Operators who deploy and maintain
• QA_TESTER - Testers who validate functionality

Related Documentation

HTML Reports with Help Links NEW v3.0.0

The framework now supports dual-mode report generation - producing both Markdown and HTML reports simultaneously. HTML reports feature a modern dark theme, interactive help links powered by Perplexity.ai ?, and topic-based organization.

Enabling HTML Reports

# Report output formats (both can be true for dual output)
reportOutputMarkdown=true    # Default: true (backward compatible)
reportOutputHtml=true        # Default: false (opt-in)

# Help links configuration
reportHelpLinksEnabled=true  # Enable ? icons with Perplexity links
reportHelpLinksProvider=perplexity  # AI provider for help queries

HTML Report Features

• Dark Theme - Professional styling with color-coded grades
• Interactive Help Links - Click ? icons for Perplexity.ai explanations
• Topic-Based Organization - 8 self-contained topic sections
• Table of Contents - Clickable navigation with grades and findings counts
• Severity Styling - Color-coded findings (Critical=red, High=orange, Medium=yellow, Low=blue)

Topic-Based Architecture

Grading Algorithm

The overall grade is calculated using a weighted average of topic grades:

• A = 95 points, B = 85, C = 75, D = 65, F = 40
• Each topic contributes: (grade points × weight)
• Sum of weighted scores determines overall grade
• Severity-aware topic grading: CRITICAL→F, HIGH→C/D, MEDIUM→A-/B, LOW→A-

Code Example

// Configure reporter for dual output
FW_HttpReporter reporter = new FW_HttpReporter();
reporter.setReportDepth(ReportDepth.COMPREHENSIVE);
reporter.setTargetAudience(FW_AdvisorAudience.SECURITY_ENGINEER);

// Generate both MD and HTML reports
String mdReport = reporter.generateReport(httpTransaction);
String htmlReport = reporter.generateHtmlReport(httpTransaction);

What's New in v3.0.0

• HTML Reports with Help Links - Dual-mode MD + HTML output with Perplexity.ai integration
• Topic-Based Architecture - 8 self-contained topic sections with independent grading
• Weighted Grade Calculation - Overall grade reflects topic grades (replaces penalty system)
• Severity-Aware Grading - Topics grade based on CRITICAL, HIGH, MEDIUM, LOW findings
• New Configuration Properties - reportOutputHtml, reportHelpLinksEnabled

What's New in v2.2.0

• Report Depth Levels - 3 configurable depths (EXECUTIVE, STANDARD, COMPREHENSIVE)
• Audience Configuration - 6 audience types supported
• 18 Report Configurations - Any depth + any audience combination
• Enhanced API - New setReportDepth() and setTargetAudience() methods