🛡️ SENTINEL

Security-Headers & Clickjacking Bulk Scanner

Audit the HTTP security posture of one host or a thousand — weighted header grading, clickjacking verdicts, cookie-flag checks, and clean HTML/CSV reports, all in one fast, thread-pooled CLI.

---

✨ Features

• Single or bulk scanning — one -u URL or a -l targets.txt file (one URL per line, # comments allowed).
• Weighted security-header audit across the modern header set (CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy) plus a note on the deprecated X-XSS-Protection.
• Clickjacking verdict — a target is EXPOSED unless it ships a restrictive X-Frame-Options (DENY/SAMEORIGIN) or a CSP frame-ancestors directive, with the reason spelled out.
• Cookie-flag checks — flags Set-Cookie values that are missing Secure, HttpOnly, or SameSite.
• 0–100 score → A–F grade per target, derived from the weighted headers that are present.
• Concurrency via ThreadPoolExecutor with a configurable --threads, thread-safe result collection, and order-preserving output.
• Three outputs — a coloured console table + details (colorama), an optional standalone dark-themed HTML report with grade badges and a sortable table, and an optional CSV export.
• Robust — every target is isolated; a dead host becomes an ERROR row instead of killing the batch. Actionable remediation advice for each missing header.

---

📊 The Grading Model

Each header carries a weight. The maximum possible score is the sum of all weights = 100. A target earns a header's weight when that header is present (and non-empty). The total is mapped to a letter grade.

Header	Weight	Why it matters
Content-Security-Policy	30	Strongest defence against XSS / injection.
Strict-Transport-Security	20	Forces HTTPS, prevents SSL-strip / downgrade.
X-Frame-Options	15	Blocks framing (clickjacking).
X-Content-Type-Options	12	Stops MIME-sniffing (nosniff).
Referrer-Policy	12	Limits referrer leakage.
Permissions-Policy	11	Disables unused powerful browser features.
X-XSS-Protection	0	Deprecated — reported as a note, never rewarded.

Score → Grade bands:

Score	Grade
90–100	A
80–89	B
65–79	C
50–64	D
35–49	E
0–34	F

The clickjacking verdict and cookie findings are reported alongside the grade but do not change the numeric score — they are separate, explicit signals.

---

📦 Install

git clone https://github.com/<your-user>/SENTINEL.git
cd SENTINEL
pip install -r requirements.txt

Requires Python 3.8+. Dependencies: requests, colorama.

---

🚀 Usage

Scan a single target:

python sentinel.py -u https://example.com

Scan a list, with 20 threads, and export both reports:

python sentinel.py -l targets.txt --threads 20 --html report.html --csv out.csv

All options:

-u, --url URL       Single target URL to scan
-l, --list FILE     File with one URL per line
--threads N         Concurrent worker threads (default: 10)
--timeout N         Per-request timeout in seconds (default: 12)
--html FILE         Write a dark-themed HTML report
--csv FILE          Write a CSV export
--version           Show version and exit

Sample targets.txt

# One URL per line; '#' comments and blank lines are ignored.
example.com
https://example.org
https://example.net

---

🖥️ Sample Output

   _____ ______ _   _ _______ _____ _   _ ______ _
  / ____|  ____| \ | |__   __|_   _| \ | |  ____| |
 | (___ | |__  |  \| |  | |    | | |  \| | |__  | |
  \___ \|  __| | . ` |  | |    | | | . ` |  __| | |
  ____) | |____| |\  |  | |   _| |_| |\  | |____| |____
 |_____/|______|_| \_|  |_|  |_____|_| \_|______|______|

      Security-Headers & Clickjacking Bulk Scanner
                  v1.0.0  ·  by Əliəsgər Fətullayev

TARGET                              GR     SCORE    CLICKJK     MISSING HEADERS
-----------------------------------------------------------------------------------
https://secure.example.com          A      100/100  PROTECT     none
https://shop.example.org            C      65/100   EXPOSED     CSP, Permissions
https://legacy.example.net          F      12/100   EXPOSED     CSP, HSTS, XFO, ...
https://dead.example.io             ERR    -        -           Connection timed out

DETAILS
============================================================

https://shop.example.org
  HTTP 200  ->  https://shop.example.org/
  Grade: C   Score: 65/100
  Clickjacking: EXPOSED No restrictive X-Frame-Options and no CSP frame-ancestors directive
  Present:
    + Strict-Transport-Security
    + X-Frame-Options
    + X-Content-Type-Options
    + Referrer-Policy
  Missing (advice):
    - Content-Security-Policy: Add a Content-Security-Policy to restrict script/style sources ...
    - Permissions-Policy: Add a Permissions-Policy to disable powerful browser features ...
  Cookie issues:
    ! Cookie 'session': missing Secure, missing SameSite

(Values above are illustrative — SENTINEL ships with no hardcoded live targets.)

---

⚠️ Legal / Ethical Use

SENTINEL performs passive reconnaissance: it sends a single ordinary GET request per target and inspects the response headers — no exploitation, no fuzzing, no payloads. Even so, only scan systems you own or are explicitly authorised to test. You are solely responsible for how you use this tool. It is provided for education and authorised security assessment only.

---

👤 Author

Əliəsgər Fətullayev Cybersecurity student · offensive-security & tooling portfolio.

Released under the MIT License © 2026.