yandex/gixy

Features

• Security Auditing - Provides automated security auditing of Nginx configuration files to identify vulnerabilities before deployment.
• Static Analysis Security Testing - Performs static analysis on Nginx configuration files to identify security vulnerabilities without executing the server.
• Configuration - Provides static analysis of Nginx configuration files to detect vulnerabilities and misconfigurations.
• Proxy Security Auditing - Analyzes Nginx proxy settings to detect server-side request forgery and unsafe internal redirections.
• HTTP Header Validations - Validates HTTP header patterns and inheritance rules to prevent unauthorized third-party access and request smuggling.
• HTTP Header Analyzers - Analyzes Referer and Origin header regex patterns to identify misconfigurations that permit unauthorized domains.
• Host Header Validations - Identifies risks where forged Host headers could lead to phishing or server-side request forgery.
• Infrastructure as Code Scanners - Functions as a security scanner for infrastructure-as-code by analyzing Nginx server definitions.
• Request Forgery Protections - Detects unsafe proxy settings and missing directives in Nginx that could allow server-side request forgery.
• Path Traversal Protections - Scans Nginx alias directives to ensure directory separators are present, preventing path traversal attacks.
• Web Server Hardening - Identifies and helps remediate common web server flaws such as path traversal and host spoofing.
• Web Server Security Auditors - Scans Nginx configurations for high-risk flaws like host spoofing, path traversal, and SSRF.
• Static Analysis Rule Engines - Employs a rule engine to evaluate predefined security patterns against the Nginx configuration tree.
• Configuration - Resolves include directives to ensure all dependent configuration files are comprehensively scanned for flaws.
• Configuration Linters - Detects structural flaws and header redefinition errors in web server configuration files.
• HTTP Splitting Analysis - Identifies configurations allowing line break characters in requests or responses to prevent backend attacks.
• Referrer Header Management - Validates Nginx configurations to ensure Referrer headers are required, preventing the bypass of access controls.
• Header Inheritance Analysis - Identifies instances where response headers are discarded due to inheritance rules in nested configuration blocks.
• Abstract Syntax Tree Parsing - Implements the conversion of Nginx configuration files into an abstract syntax tree for structural security analysis.
• Configuration Inheritance Tracking - Tracks how configuration settings propagate from global to server and location blocks to detect header overrides.
• Configuration Pattern Validation - Uses regular expressions to verify that header values and domain patterns conform to secure specifications.
• Recursive Configuration Resolution - Resolves include directives recursively to flatten hierarchical configuration files into a single analysis tree.
• Infrastructure and Configuration - Analyzes Nginx configurations to prevent misconfigurations.
• Code Quality Linters - Analyzes Nginx configurations to prevent common misconfigurations.
• Configuration Management - Static analysis tool to identify common configuration errors.

Star history