mcdetect
v1.0.6
Published
Catch mixed content issues in the wild
Downloads
22
Maintainers
Readme
mcdetect - catch mixed content issues in the wild
mcdetect is a tool that detects mixed content issues with certainty.
Motivation
Tools used to catch mixed content issues often rely on parsing the DOM to determine if insecure content will be loaded in a specific page. Consequently they may report false negatives since not all such issues can be detected statically.
mcdetect can determine with absolute certainty if any mixed content errors or warnings actually occur on a page. It does this by visiting the pages and evaluating their Javascript like a regular browser would do. In other words, it does not report false negatives.
It does this by leveraging Headless Chrome that shipped with Chrome 59 and the DevTools Protocol.
Requirements
- Node 7.6.0 or later
Installation
$ npm install -g mcdetect
Usage
Checking a single target page:
$ mcdetect https://example.com https://google.com
Checking multiple targets (if no protocol is specified, it is assumed to be "https://"):
$ mcdetect example.com google.com
Multiple targets can also be given via a config file:
$ cat my_urls.json
{
"targets": [
"googlesamples.github.io/web-fundamentals/fundamentals/security/prevent-mixed-content/xmlhttprequest-example.html",
"googlesamples.github.io/web-fundamentals/fundamentals/security/prevent-mixed-content/passive-mixed-content.html"
]
}
$ mcdetect --config my_urls.json
For more usage examples and options see mcdetect --help
.
TODO
- Add scraping mode (with max depth)
- More output formats (eg. json, csv, pdf)
- error handling (modes: exit on error, ignore errors, report errors)
- interactive mode
- follow redirects
- read targets from stdin
License
mcdetect is licensed under MIT. See LICENSE.