vamp-http-audit

Overview

vamp-http-audit is the HTTP layer companion to vamp-ssl-audit. Where the TLS auditor covers the transport layer, this tool covers HTTP security headers, CORS misconfigurations, cookie flag analysis, server information disclosure, and open redirect vulnerabilities. It uses the same SSLabs-style A+–F grading system and supports the same output formats (JSON, HTML, Markdown, CSV), making it a natural fit in any automated assessment pipeline.

Features

• SSLabs-style letter grading A+ to F based on combined HTTP security posture
• Security header analysis: CSP (directive-level deep inspection including unsafe-inline, unsafe-eval, wildcards, frame-ancestors), HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COEP, COOP, CORP
• CORS misconfiguration probing: attacker-origin reflection, wildcard + credentials (CRITICAL), null-origin acceptance (iframe sandbox bypass)
• Cookie security analysis: Secure, HttpOnly, SameSite flags; __Host- and __Secure- prefix enforcement
• Server information disclosure detection: Server, X-Powered-By, X-AspNet-Version, X-AspNetMvc-Version, X-Generator, debug headers
• Open redirect testing across 16 common parameters: url, redirect, next, return, goto, destination, redir, target, link, forward, location, rurl, returl, redirect_uri, redirect_url, return_url
• GraphQL endpoint detection and introspection availability check
• Concurrent multi-URL scanning with configurable worker pool (--workers, default 5)
• Zero third-party dependencies — only Python stdlib (urllib) and rich
• Export to Console, JSON, HTML (dark-theme with collapsible remediations), Markdown, and CSV

Requirements

• Python 3.9 or later
• rich >= 13.7.0

Installation

git clone https://github.com/belky-me/vamp-http-audit.git
cd vamp-http-audit
python3 -m venv .venv
source .venv/bin/activate   # Windows: .venv\Scripts\activate
pip install -r requirements.txt

Usage

python3 vamp_http_audit.py --help

usage: vamp_http_audit.py [-h] [-u URL] [--file FILE]
                           [--timeout TIMEOUT] [--workers WORKERS]
                           [--json FILE] [--html FILE]
                           [--markdown FILE] [--csv FILE]
                           [--no-verify-ssl]
                           [--client CLIENT] [--engagement ENGAGEMENT]
                           [--auditor AUDITOR] [--report-scope SCOPE]
                           [--report-html FILE] [--report-pdf FILE]

vamp-http-audit — HTTP Security Headers & CORS Auditor (VampSecure Labs)

Examples

# Audit a single URL
python3 vamp_http_audit.py -u https://example.com

# Audit multiple URLs in one command
python3 vamp_http_audit.py -u https://example.com -u https://api.example.com

# Audit a list of URLs from file with 10 parallel workers
python3 vamp_http_audit.py --file urls.txt --workers 10

# Export results to all formats
python3 vamp_http_audit.py -u https://example.com \
    --json results.json --html report.html --markdown report.md --csv report.csv

# Skip TLS verification for self-signed certificates
python3 vamp_http_audit.py -u https://internal.staging.local --no-verify-ssl

# Generate client-ready engagement report
python3 vamp_http_audit.py --file urls.txt \
    --client "Acme Corp" --engagement "HTTP Headers Review Q3 2026" \
    --auditor "J. Smith" --report-html client_report.html

CLI Reference

Output Formats

Grading Scale

Exit Codes

Legal Notice

Use exclusively on systems you own or for which you hold explicit written authorization from the system owner. VampSecure Studios assumes no liability for unauthorized use.

Part of VampSecure Labs Toolkit

vamp-http-audit is one tool in the VampSecure Labs security research toolkit. For the full toolkit including the orchestrator that runs all tools in sequence and aggregates findings into a single engagement report, see:

• Portfolio: github.com/belky-me
• Orchestrator: github.com/belky-me/vamp-orchestrator

© VampSecure Studios — VampSecure Labs Security Research Division