Shulou(Shulou.com)06/01 Report--

This article mainly introduces how to install and use Gixy, has a certain reference value, interested friends can refer to, I hope you can learn a lot after reading this article, the following let the editor take you to understand it.

Gixy is a tool for analyzing Nginx configurations. The main goal of Gixy is to prevent security configuration errors and to automatically detect defects.

The Gixy feature finds server-side request forgery. Verify the HTTP split. Verify the referrer/origin problem. Verify that the Response Headers is redefined correctly through the add_header directive. Verify that the requested host header is forged. Verify that the valid_referers is empty. Verify that there is a multiline host header. Gixy installation

Gixy is an application developed by Python. Currently, the supported Python versions are 2.7 and 3.5 +.

The installation steps are very simple. You can install them directly using pip:

$pip install gixy

If your system is older, the Python version that comes with it is lower. You can upgrade the Python version by referring to "Building a python Virtual Environment with pyenv" or "how to enable Software set Software Collections (SCL) on CentOS".

Gixy usage

Gixy checks the / etc/nginx/nginx.conf configuration file by default.

$gixy

You can also specify the location of the NGINX configuration file.

$gixy / usr/local/nginx/conf/nginx.conf= Results = No issues found.= Summary = Total issues:Unspecified: 0Low: 0 Medium: 0High: 0

Let's take a look at an example of a problem with the http discount configuration. Modify the Nginx configuration:

Server {... Location ~ / v1 / ((? [^.] *) / .json)? ${add_header X-Action $action;}... }

Run Gixy again to check the configuration.

$gixy / usr/local/nginx/conf/nginx.conf= Results = > > Problem: [http_splitting] Possible HTTP-Splitting vulnerability.Description: Using variables that can contain "/ n" may lead to http injection.Additional info: https://github.com/yandex/gixy/blob/master/docs/en/plugins/httpsplitting.mdReason: At least variable "$action" can contain "/ n" Pseudo config:server {server_name localhost mike.hi-linux.com Location ~ / v1 / ((? [^.] *) / .json)? ${add_header X-Action $action;}} = Summary = Total issues:Unspecified: 0Low: 0Medium: 0High: 1

You can see from the results that a problem has been detected, indicating that the problem type is http_splitting. The reason is that the $action variable can contain line breaks. This is the HTTP response header split vulnerability, which is exploited through CRLFZ injection.

If you want to ignore some kind of error checking for the time being, you can use the-skips parameter:

$gixy-skips http_splitting / usr/local/nginx/conf/nginx.conf= Results = No issues found.= Summary = Total issues:Unspecified: 0Low: 0Medium: 0High: 0 Thank you for reading this article carefully. I hope the article "how to install and use Gixy" shared by the editor will be helpful to you. At the same time, I hope you will support us and pay attention to the industry information channel. More related knowledge is waiting for you to learn!

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.