From 6f6663b4538e97756ed93d45856767677f75d7ce Mon Sep 17 00:00:00 2001
From: ekultek <thomas.perkins23@icloud.com>
Date: Tue, 14 Nov 2017 19:40:21 -0600
Subject: [PATCH] added a new header to the check to see if they have
 protection against MITM attacks (Public-Key-Pins)

---
 etc/xml/headers.xml          | 1 +
 lib/header_check/__init__.py | 3 +--
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/etc/xml/headers.xml b/etc/xml/headers.xml
index 0890e23..ab2aaf3 100644
--- a/etc/xml/headers.xml
+++ b/etc/xml/headers.xml
@@ -4,4 +4,5 @@
     <header name="X-Frame-Options"/>
     <header name="X-Content-Type-Options"/>
     <header name="Content-Security-Policy"/>
+    <header name="Public-Key-Pins"/>
 </headers>
\ No newline at end of file
diff --git a/lib/header_check/__init__.py b/lib/header_check/__init__.py
index 3bb3253..b907e29 100644
--- a/lib/header_check/__init__.py
+++ b/lib/header_check/__init__.py
@@ -71,8 +71,6 @@ def detect_protection(url, **kwargs):
 
         retval = []
         if status != 200 and "not found" not in html.lower():
-            if "Apache" in headers["Server"] and "you don't have permission" in html.lower():
-                return None
             file_list = [f for f in os.listdir(DETECT_FIREWALL_PATH) if not any(ex in f for ex in ["__init__", ".pyc"])]
             for item in file_list:
                 item = item[:-3]
@@ -198,6 +196,7 @@ def main_header_check(url, **kwargs):
         "strict-transport": ("protection against unencrypted connections (force HTTPS connection)", "HTTPS"),
         "x-frame": ("protection against clickjacking vulnerabilities", "CLICKJACKING"),
         "x-content": ("protection against MIME type attacks", "MIME"),
+        "public-key": ("protection to reduce success rates of MITM attacks", "MITM"),
         "content-security": ("protection against multiple attacks", "ALL")
     }