Ecosyste.ms: Awesome

An open API service indexing awesome lists of open source software.

Awesome Lists | Featured Topics | Projects

https://github.com/dvershinin/gixy

NGINX configuration static analyzer
https://github.com/dvershinin/gixy

checker configuration linter linting nginx nginx-configuration python security server

Last synced: 9 days ago
JSON representation

NGINX configuration static analyzer

Host: GitHub
URL: https://github.com/dvershinin/gixy
Owner: dvershinin
License: other
Fork: true (yandex/gixy)
Created: 2019-07-25T14:05:35.000Z (over 5 years ago)
Default Branch: master
Last Pushed: 2024-08-17T12:32:54.000Z (3 months ago)
Last Synced: 2024-09-18T19:26:38.774Z (about 2 months ago)
Topics: checker, configuration, linter, linting, nginx, nginx-configuration, python, security, server
Language: Python
Homepage: https://gixy.getpagespeed.com
Size: 905 KB
Stars: 17
Watchers: 5
Forks: 2
Open Issues: 4
Metadata Files:
- Readme: README.RU.md
- Contributing: CONTRIBUTING.md
- Funding: .github/FUNDING.yml
- License: LICENSE

Awesome Lists containing this project

awesome - dvershinin/gixy - Nginx configuration static analyzer (others)

README

        GIXY

====

[![Mozilla Public License 2.0](https://img.shields.io/github/license/dvershinin/gixy.svg?style=flat-square)](https://github.com/dvershinin/gixy/blob/master/LICENSE)

[![Build Status](https://img.shields.io/travis/dvershinin/gixy.svg?style=flat-square)](https://travis-ci.org/dvershinin/gixy)

[![Your feedback is greatly appreciated](https://img.shields.io/maintenance/yes/2018.svg?style=flat-square)](https://github.com/dvershinin/gixy/issues/new)

[![GitHub issues](https://img.shields.io/github/issues/dvershinin/gixy.svg?style=flat-square)](https://github.com/dvershinin/gixy/issues)

[![GitHub pull requests](https://img.shields.io/github/issues-pr/dvershinin/gixy.svg?style=flat-square)](https://github.com/dvershinin/gixy/pulls)

# Overview



Gixy — это утилита для анализа конфигурации Nginx.

Большей частью служит для обнаружения проблем безопасности, но может искать и иные ошибки.

Официально поддерживаются версии Python >= 3.6.

 

# Что умеет

На текущий момент Gixy способна обнаружить:

*   [[ssrf] Server Side Request Forgery](https://github.com/dvershinin/gixy/blob/master/docs/ru/plugins/ssrf.md)

*   [[http_splitting] HTTP Splitting](https://github.com/dvershinin/gixy/blob/master/docs/ru/plugins/httpsplitting.md)

*   [[origins] Проблемы валидации referrer/origin](https://github.com/dvershinin/gixy/blob/master/docs/ru/plugins/origins.md)

*   [[add_header_redefinition] Переопределение "вышестоящих" заголовков ответа директивой "add_header"](https://github.com/dvershinin/gixy/blob/master/docs/ru/plugins/addheaderredefinition.md)

*   [[host_spoofing] Подделка заголовка запроса Host](https://github.com/dvershinin/gixy/blob/master/docs/ru/plugins/hostspoofing.md)

*   [[valid_referers] none in valid_referers](https://github.com/dvershinin/gixy/blob/master/docs/ru/plugins/validreferers.md)

*   [[add_header_multiline] Многострочные заголовоки ответа](https://github.com/dvershinin/gixy/blob/master/docs/ru/plugins/addheadermultiline.md)

*   [[alias_traversal] Path traversal при использовании alias](https://github.com/dvershinin/gixy/blob/master/docs/ru/plugins/aliastraversal.md)

Проблемы, которым Gixy только учится можно найти в [Issues с меткой "new plugin"](https://github.com/dvershinin/gixy/issues?q=is%3Aissue+is%3Aopen+label%3A%22new+plugin%22)

# Установка

Наиболее простой способ установки Gixy - воспользоваться pip для установки из [PyPI](https://pypi.python.org/pypi/gixy):

```bash

pip install gixy

```

# Использование

После установки должна стать доступна консольная утилита `gixy`.

По умолчанию Gixy ищет конфигурацию по стандартному пути `/etc/nginx/nginx.conf`, однако вы можете указать специфичное расположение:

```

$ gixy /etc/nginx/nginx.conf

==================== Results ===================

Problem: [http_splitting] Possible HTTP-Splitting vulnerability.

Description: Using variables that can contain "\n" may lead to http injection.

Additional info: https://github.com/dvershinin/gixy/wiki/ru/httpsplitting

Reason: At least variable "$action" can contain "\n"

Pseudo config:

include /etc/nginx/sites/default.conf;

	server {

		location ~ /v1/((?[^.]*)\.json)?$ {

			add_header X-Action $action;

		}

	}

==================== Summary ===================

Total issues:

    Unspecified: 0

    Low: 0

    Medium: 0

    High: 1

```

Gixy умеет обрабатывать директиву `include` и попробует максимально корректно обработать все зависимости, если что-то пошло не так можно попробовать запустить `gixy` с флагом `-d` для вывода дополнительной информации.

Все доступные опции:

```

$ gixy -h

usage: gixy [-h] [-c CONFIG_FILE] [--write-config CONFIG_OUTPUT_PATH]

            [-v] [-l] [-f {console,text,json}] [-o OUTPUT_FILE] [-d]

            [--tests TESTS] [--skips SKIPS] [--disable-includes]

            [--origins-domains domains]

            [--origins-https-only https_only]

            [--add-header-redefinition-headers headers]

            [nginx.conf]

Gixy - a Nginx configuration [sec]analyzer

positional arguments:

  nginx.conf            Path to nginx.conf, e.g. /etc/nginx/nginx.conf

optional arguments:

  -h, --help            show this help message and exit

  -c CONFIG_FILE, --config CONFIG_FILE

                        config file path

  --write-config CONFIG_OUTPUT_PATH

                        takes the current command line args and writes them

                        out to a config file at the given path, then exits

  -v, --version         show program's version number and exit

  -l, --level           Report issues of a given severity level or higher (-l

                        for LOW, -ll for MEDIUM, -lll for HIGH)

  -f {console,text,json}, --format {console,text,json}

                        Specify output format

  -o OUTPUT_FILE, --output OUTPUT_FILE

                        Write report to file

  -d, --debug           Turn on debug mode

  --tests TESTS         Comma-separated list of tests to run

  --skips SKIPS         Comma-separated list of tests to skip

  --disable-includes    Disable "include" directive processing

plugins options:

  --origins-domains domains

                        Default: *

  --origins-https-only https_only

                        Default: False

  --add-header-redefinition-headers headers

                        Default: content-security-policy,x-xss-

                        protection,x-frame-options,x-content-type-

                        options,strict-transport-security,cache-control

available plugins:

	host_spoofing

	add_header_multiline

	http_splitting

	valid_referers

	origins

	add_header_redefinition

	ssrf

```

# Contributing

Contributions to Gixy are always welcome! You can help us in different ways:

  * Open an issue with suggestions for improvements and errors you're facing;

  * Fork this repository and submit a pull request;

  * Improve the documentation.

Code guidelines:

  * Python code style should follow [pep8](https://www.python.org/dev/peps/pep-0008/) standards whenever possible;

  * Pull requests with new plugins must have unit tests for it.