web漏洞与修复

一、web漏洞

检测到目标X-Content-Type-Options响应头缺失

检测到目标X-XSS-Protection响应头缺失

检测到目标Content-Security-Policy响应头缺失

检测到目标Strict-Transport-Security响应头缺失

检测到目标Referrer-Policy响应头缺失

检测到目标X-Permitted-Cross-Domain-Policies响应头缺失

检测到目标X-Download-Options响应头缺失

检测到目标网站存在无效链接

点击劫持：X-Frame-Options未配置

?

二、修复方式

可以在nginx http块中配置

? ?# 相关安全漏洞响应头
? ?# 检测到目标 X-Content-Type-Options响应头缺失 这个暂时不开启，不然部分banner无法使用
? ?add_header X-Content-Type-Options nosniff;
? ?# 检测到目标 X-XSS-Protection响应头缺失
? ?add_header X-XSS-Protection "1; mode=block";
? ?# 检测到目标 Content-Security-Policy响应头缺失
? ?add_header Content-Security-Policy "default-src 'self' http: https://* data: blob: 'unsafe-eval' 'unsafe-inline';child-src 'none' " always;
? ?# 检测到目标 Referrer-Policy响应头缺失
? ?add_header Referrer-Policy "no-referrer-when-downgrade" always;
? ?# 检测到目标 X-Permitted-Cross-Domain-Policies响应头缺失
? ?add_header X-Permitted-Cross-Domain-Policies none;
? ?# 检测到目标 X-Download-Options响应头缺失
? ?add_header X-Download-Options noopen;
? ?# 检测到目标 Strict-Transport-Security响应头缺失
? ?add_header Strict-Transport-Security "max-age=63072000; includeSubdomains; preload";

   # 相关安全漏洞响应头
   # 检测到目标 X-Content-Type-Options响应头缺失 这个暂时不开启，不然部分banner无法使用
   add_header X-Content-Type-Options nosniff;
   # 检测到目标 X-XSS-Protection响应头缺失
   add_header X-XSS-Protection "1; mode=block";
   # 检测到目标 Content-Security-Policy响应头缺失
   add_header Content-Security-Policy "default-src 'self' http: https://* data: blob: 'unsafe-eval' 'unsafe-inline';child-src 'none' " always;
   # 检测到目标 Referrer-Policy响应头缺失
   add_header Referrer-Policy "no-referrer-when-downgrade" always;
   # 检测到目标 X-Permitted-Cross-Domain-Policies响应头缺失
   add_header X-Permitted-Cross-Domain-Policies none;
   # 检测到目标 X-Download-Options响应头缺失
   add_header X-Download-Options noopen;
   # 检测到目标 Strict-Transport-Security响应头缺失
   add_header Strict-Transport-Security "max-age=63072000; includeSubdomains; preload";

完整http块

#http块
http {
  fastcgi_connect_timeout 300;
  fastcgi_send_timeout 300;
  fastcgi_read_timeout 300;
  fastcgi_buffer_size 256k;
  fastcgi_buffers 2 256k;
  fastcgi_busy_buffers_size 256k;
  fastcgi_temp_file_write_size 256k;
  ssl_protocols      TLSv1 TLSv1.1  TLSv1.2 TLSv1.3;

   # 相关安全漏洞响应头
   # 检测到目标 X-Content-Type-Options响应头缺失 这个暂时不开启，不然部分banner无法使用
   add_header X-Content-Type-Options nosniff;
   # 检测到目标 X-XSS-Protection响应头缺失
   add_header X-XSS-Protection "1; mode=block";
   # 检测到目标 Content-Security-Policy响应头缺失
   add_header Content-Security-Policy "default-src 'self' http: https://* data: blob: 'unsafe-eval' 'unsafe-inline';child-src 'none' " always;
   # 检测到目标 Referrer-Policy响应头缺失
   add_header Referrer-Policy "no-referrer-when-downgrade" always;
   # 检测到目标 X-Permitted-Cross-Domain-Policies响应头缺失
   add_header X-Permitted-Cross-Domain-Policies none;
   # 检测到目标 X-Download-Options响应头缺失
   add_header X-Download-Options noopen;
   # 检测到目标 Strict-Transport-Security响应头缺失
   add_header Strict-Transport-Security "max-age=63072000; includeSubdomains; preload";
	#隐藏nginx版本信息
	server_tokens off;
	#文件扩展名与文件类型映射表
    include       /etc/nginx/mime.types;
	#默认文件类型，默认为text/plain
    default_type  application/octet-stream;
    
	#日志格式
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main if=$ignore_ua;

    sendfile        on;
    #tcp_nopush     on;
	
	#连接超时时间，默认为75s，可以在http，server，location块。
    keepalive_timeout  300;

    #gzip  on;
    client_max_body_size 1024m;
	
	#包含的自定义配置文件块
    include /etc/nginx/conf.d/*.conf;

	#是否传递4xx和5xx错误信息到客户端，或者允许nginx使用error_page处理错误信息。
    fastcgi_intercept_errors on;

   #Disable logging for ELB healthcheck. It creates lots of noise on logging platform
   ##关闭健康检测日志的输出
   map $http_user_agent $ignore_ua {
   default                 1;
   "clb-healthcheck"       0;

     }

}

三、验证