proxyaudit

A reverse proxy / API gateway security scanner — TLS, HTTP security headers, header trust boundaries, and exposed management interfaces.

proxyaudit dynamically tests whether a reverse proxy or API gateway is securely configured: TLS/transport, HTTP security headers, client-IP/header trust boundaries, and information disclosure via exposed management interfaces. Its check engine (proxy/) is built on harnessx, the same check orchestration library used by VulnAPI and jwtop — part of the CerberAuth DAST portfolio.

Install

go install go install github.com/cerberauth/proxyaudit@latest

Homebrew brew install cerberauth/tap/proxyaudit

Docker docker run --rm ghcr.io/cerberauth/proxyaudit scan <url>

See the installation guide for more options (Scoop, apt/yum/apk, Arch, Snap, winget, Chocolatey).

Usage

proxyaudit scan https://proxy.example.com

Flags:
      --aggressive                     Enable Agg-tier checks that plant content in a shared cache (cache poisoning, cache deception)
      --engine string                  Hint the fronting proxy engine: nginx, traefik, envoy, caddy, or haproxy (optional, overrides auto-detection)
      --format string                  terminal display format (default "terminal")
      --no-color                       disable ANSI colors in terminal output
      --output string                  file path to additionally write the report to
      --output-format string           format for --output (default "json")
      --quiet                          suppress terminal display of the report
      --report-url string              HTTP endpoint to POST the report to
      --report-header stringToString   additional HTTP headers for the report transport (key=value)
      --report-format string           format for --report-url (default "json")
      --show-all-findings              show every finding on stdout, not just vulnerable ones

Exit codes: 0 no findings, 1 findings present, 2 runtime/connection error — standard for CI usage. See the GitHub Actions guide for CI examples.

Every check is non-destructive and read-only by default (single or few requests, no brute-forcing or state mutation). The two --aggressive caching checks are the exception — they deliberately plant content in a shared cache to confirm cache poisoning/deception, and are skipped unless --aggressive is set. Use only against systems you own or have explicit written permission to test.

Checks (v0.1)

See the checks reference for the full list with CWE/OWASP mapping and remediation.

• TLS/Transport: protocol version, cipher strength/forward secrecy, certificate chain/expiry/hostname/OCSP stapling, HTTP→HTTPS redirect, HSTS.
• HTTP Security Headers: CSP, X-Frame-Options/frame-ancestors, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, Server/ X-Powered-By banner disclosure, cookie flags, CORS misconfiguration (reflected/wildcard origin with credentials, null-origin acceptance, preflight correctness/cache duration).
• Client-IP & Header Trust Boundary: X-Forwarded-For, X-Real-IP, True-Client-IP, X-Forwarded-Host reflection, Host header injection, virtual-host confusion via a crafted Host header, RFC 7239 Forwarded vs. legacy header consistency, and IP-based access control bypass via a spoofed client-IP header.
• Information Disclosure & Exposed Management Interfaces: verbose error pages, exposed proxy admin/status interfaces (Traefik, HAProxy, Envoy, nginx, Apache), directory listing, config/secrets file exposure.
• Path & Access Control Bypass: access control bypassed via path normalization (case variation, duplicate/trailing slash, encoded traversal, double-encoding, null byte, matrix parameter) or via an unexpected HTTP method reaching the same protected path; nginx off-by-slash alias traversal (a location without a trailing slash paired with an alias directive).
• Caching Behavior & Web Cache Deception: authenticated responses marked cacheable without an RFC 9111 §3.5 opt-in, undeclared cache-key inputs (Vary inconsistency), cache poisoning via an unkeyed header (X-Forwarded-Host, X-Original-URL, Accept-Language), and web cache deception via static-extension/path confusion. Reuses cache-detective's RFC 9111 cacheability analysis and CDN cache-status detection.
• WAF / Filtering Behavior Validation: baseline SQLi, XSS, and path traversal payloads confirmed blocked rather than passed through, encoding-based bypass attempts (double URL-encoding, Unicode normalization, case variation), and filtering consistency across content types and encodings (form, JSON, multipart, plain text, gzip).

Documentation

Full documentation, including installation options, the CLI reference, the checks reference, and CI/Docker guides, is at cerberauth.com/docs/proxyaudit.

Contributing

Issues and pull requests are welcome. Run the test suite with:

go build ./...
go vet ./...
go test ./...

License

MIT — see LICENSE.