Security-TXT is a python package for retrieving, parsing and manipulating security.txt files.

Frank

Last update: Feb 7, 2022

Related tags

Overview

Security-TXT

Security-TXT is a simple security.txt library.

>> sec.contact ['https://hackerone.com/adobe', 'mailto:[email protected]'] >>> sec.signature 'iQIzBAEBCAAdFiEEqvs1Pw7pNc/gvcvRX9Oj3XV3pEYFAmEBhSgACgk...' >>> sec.expired False">

>>> from securitytxt import SecurityTXT
>>> sec = SecurityTXT.from_url("adobe.com")
>>> sec.contact
['https://hackerone.com/adobe', 'mailto:[email protected]']
>>> sec.signature
'iQIzBAEBCAAdFiEEqvs1Pw7pNc/gvcvRX9Oj3XV3pEYFAmEBhSgACgk...'
>>> sec.expired
False

Security-TXT allows you to easily retrieve, parse and manipulate security.txt files. It tries to follow the latest draft RFC as closely as possible, while it still parses security.txt files that contain minor mistakes. The package is well-documented, thereby easy to use in combination with pydoc:

Installation

Security-TXT is not yet available on PyPI. I am currently working on this. The package has only been tested with Python 3.6.8+

Supported Features & Best–Practices

The package has been build to support easy and automated retrieval and parsing of security.txt files. Therefore, features include:

Automated searching for security.txt files on specified host.
Signature parsing for signed files.
Allows for parsing unknown fields and comments that are present in security.txt file.
Automated validity tests for parsed security.txt files.
Every class and function is fully documented.

Soon to be implemented:

fail_silently: if a file format is invalid, it continues parsing the rest of the line instead of raising an error.

Course: Information Security with Python

Curso: Segurança da Informação com Python Curso realizado atravès da Plataforma da Digital Innovation One Prof: Bruno Dias Conteúdo: Introdução aos co

1 Nov 28, 2021

Docker is an open platform for developing, shipping, and running applications OS-level virtualization to deliver software in packages called containers However, 'security' is a top request on Docker's public roadmap This project aims at vulnerability check for such docker containers. New contributions are accepted

Docker-Vulnerability-Check Docker is an open platform for developing, shipping, and running applications OS-level virtualization to deliver software i

103 Aug 20, 2022

Providing DevOps and security teams script to identify cloud workloads that may be vulnerable to the Log4j vulnerability(CVE-2021-44228) in their AWS account.

We are providing DevOps and security teams script to identify cloud workloads that may be vulnerable to the Log4j vulnerability(CVE-2021-44228) in their AWS account. The script enables security teams to identify external-facing AWS assets by running the exploit on them, and thus be able to map them and quickly patch them

13 Jan 4, 2022

Having a weak password is not good for a system that demands high confidentiality and security of user credentials

Having a weak password is not good for a system that demands high confidentiality and security of user credentials. It turns out that people find it difficult to make up a strong password that is strong enough to prevent unauthorized users from memorizing it.

0 Feb 7, 2022

Safety checks your installed dependencies for known security vulnerabilities

Safety checks your installed dependencies for known security vulnerabilities. By default it uses the open Python vulnerability database Safety DB, but

1.4k Dec 30, 2022

HTTP security headers for Flask

Talisman: HTTP security headers for Flask Talisman is a small Flask extension that handles setting HTTP headers that can help protect against a few co

854 Dec 30, 2022

Vulnerability Scanner & Auto Exploiter You can use this tool to check the security by finding the vulnerability in your website or you can use this tool to Get Shells

About create a target list or select one target, scans then exploits, done! Vulnnr is a Vulnerability Scanner & Auto Exploiter You can use this tool t

108 Dec 4, 2021

Tools to make working the Arch Linux Security Tracker easier

This is a collection of Python scripts to make working with the Arch Linux Security Tracker easier.

6 Jul 13, 2022

Writeups for wtf-CTF hosted by Manipal Information Security Team as part of Techweek2021- INCOGNITO

wtf-CTF_Writeups Table of Contents Table of Contents Crypto Misc Reverse Pwn Web Crypto wtf_Bot Author: Madjelly Join the discord server!You know how

6 Jun 7, 2021

Comments

Certificate issues are hidden away
I am currently trying to use this library for checking and parsing my security.txt file with the URL-based example from the README.

While there are no issues with regular certificates, local testing with a self-signed one just raises a FileNotFoundError without further explanation (my local server setup is configured as HTTPS-only):

from security import SecurityTXT result = SecurityTXT.from_url('https://local-device/')

The reason is that the requests library does not support self-signed certificates by default.

Is there any chance of increasing the verbosity, for example by some logging? The culprit seems to be securitytxt.parsers.url_parser.URLParser._parse_file_url, where the following message might be useful for debugging:

HTTPSConnectionPool(host='local-device', port=443): Max retries exceeded with url: /.well-known/security.txt (Caused by SSLError(SSLError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:852)'),))

bug enhancement
opened by stefan6419846 2

Security-TXT is a python package for retrieving, parsing and manipulating security.txt files.

Related tags

Overview

Security-TXT

Installation

Supported Features & Best–Practices

You might also like...

Course: Information Security with Python

Providing DevOps and security teams script to identify cloud workloads that may be vulnerable to the Log4j vulnerability(CVE-2021-44228) in their AWS account.

Having a weak password is not good for a system that demands high confidentiality and security of user credentials

Safety checks your installed dependencies for known security vulnerabilities

HTTP security headers for Flask

Vulnerability Scanner & Auto Exploiter You can use this tool to check the security by finding the vulnerability in your website or you can use this tool to Get Shells

Tools to make working the Arch Linux Security Tracker easier

Writeups for wtf-CTF hosted by Manipal Information Security Team as part of Techweek2021- INCOGNITO

Comments

Certificate issues are hidden away

Owner

Frank

A python script to turn Ubuntu Desktop in a one stop security platform. The InfoSec Fortress installs the packages,tools, and resources to make Ubuntu 20.04 capable of both offensive and defensive security work.

Hubble is a modular, open-source security compliance framework. The project provides on-demand profile-based auditing, real-time security event notifications, alerting, and reporting. HubbleStack is a free and open source project made possible by Adobe. https://github.com/adobe

Security audit Python project dependencies against security advisory databases.

RedTeam-Security - In this repo you will get the information of Red Team Security related links

evtx-hunter helps to quickly spot interesting security-related activity in Windows Event Viewer (EVTX) files.

An experimental script to perform bulk parsing of arbitrary file features with YARA and console logging.

labsecurity is a framework and its use is for ethical hacking and computer security

Bug Alert: a service for alerting security and IT professionals of high-impact and 0day vulnerabilities

Bandit is a tool designed to find common security issues in Python code.

A Static Analysis Tool for Detecting Security Vulnerabilities in Python Web Applications