Lab 10: E-Commerce Security Audit¶

# trust_checker.py
import requests
import ssl
import socket
import re
from urllib.parse import urlparse
from datetime import datetime

def audit_site(url: str) -> dict:
    """Perform passive security and trust audit of an e-commerce URL."""
    results = {}
    hostname = urlparse(url).netloc

    print(f"\n{'='*60}")
    print(f"Security & Trust Audit: {url}")
    print(f"{'='*60}\n")

    # ── 1. HTTPS & TLS ────────────────────────────────────────────
    try:
        ctx = ssl.create_default_context()
        with ctx.wrap_socket(socket.socket(), server_hostname=hostname) as s:
            s.connect((hostname, 443))
            cert = s.getpeercert()
            tls_version = s.version()

        # Certificate expiry
        expiry_str = cert.get("notAfter", "")
        expiry = datetime.strptime(expiry_str, "%b %d %H:%M:%S %Y %Z") if expiry_str else None
        days_remaining = (expiry - datetime.now()).days if expiry else None

        results["tls_version"]     = tls_version
        results["cert_valid"]      = True
        results["cert_days_left"]  = days_remaining
        results["cert_issuer"]     = dict(cert.get("issuer", [])[-1]).get("organizationName", "Unknown")

        status = "✓" if (days_remaining or 0) > 30 else "⚠"
        print(f"{status} TLS: {tls_version} | Cert valid {days_remaining}d | Issuer: {results['cert_issuer']}")
    except Exception as e:
        results["tls_error"] = str(e)
        print(f"✗ TLS Error: {e}")

    # ── 2. Security Headers ───────────────────────────────────────
    try:
        resp = requests.get(url, timeout=10, headers={"User-Agent": "Mozilla/5.0 (Security Audit)"})
        headers = resp.headers

        security_headers = {
            "Strict-Transport-Security": "HSTS",
            "Content-Security-Policy":   "CSP",
            "X-Frame-Options":           "Clickjacking Protection",
            "X-Content-Type-Options":    "MIME Sniffing Protection",
            "Referrer-Policy":           "Referrer Policy",
            "Permissions-Policy":        "Permissions Policy"
        }

        print("\nSecurity Headers:")
        results["headers"] = {}
        for header, name in security_headers.items():
            present = header in headers
            results["headers"][header] = present
            icon = "✓" if present else "✗"
            val = headers.get(header, "MISSING")[:60] if present else "MISSING"
            print(f"  {icon} {name}: {val}")

        # Server info leak
        server = headers.get("Server", "")
        powered = headers.get("X-Powered-By", "")
        if server or powered:
            print(f"  ⚠ Server info exposed: Server={server} X-Powered-By={powered}")
        else:
            print(f"  ✓ No server version exposed")

        results["status_code"] = resp.status_code
        results["content"] = resp.text[:5000]  # for further analysis

    except Exception as e:
        results["request_error"] = str(e)
        print(f"✗ Request error: {e}")
        return results

    # ── 3. Trust Signals ──────────────────────────────────────────
    content = results.get("content", "")
    print("\nTrust Signals (page content analysis):")

    trust_checks = {
        "SSL badge/lock icon": bool(re.search(r'ssl|secure|lock', content, re.I)),
        "Reviews/ratings":     bool(re.search(r'review|rating|star|\d+\s+reviews', content, re.I)),
        "Money-back guarantee":bool(re.search(r'money.back|guarantee|return policy', content, re.I)),
        "Phone number":        bool(re.search(r'\d{3}[-.\s]\d{3}[-.\s]\d{4}', content)),
        "Physical address":    bool(re.search(r'\d+\s+\w+\s+(st|ave|blvd|rd|dr|lane)', content, re.I)),
        "Live chat widget":    bool(re.search(r'chat|intercom|zendesk|freshchat', content, re.I)),
        "Social proof":        bool(re.search(r'customers?|users?|sold|trusted', content, re.I)),
        "Payment badges":      bool(re.search(r'visa|mastercard|paypal|amex|stripe', content, re.I)),
        "BBB/Trust badge":     bool(re.search(r'bbb|trustpilot|norton|mcafee secure', content, re.I)),
    }

    results["trust_signals"] = trust_checks
    trust_score = sum(trust_checks.values())
    for signal, present in trust_checks.items():
        icon = "✓" if present else "✗"
        print(f"  {icon} {signal}")

    print(f"\nTrust Score: {trust_score}/{len(trust_checks)} signals present")

    # ── 4. Cookie Analysis ────────────────────────────────────────
    print("\nCookie Analysis:")
    cookies = resp.cookies
    for cookie in cookies:
        secure   = "✓" if cookie.secure else "✗"
        httponly = "✓" if cookie.has_nonstandard_attr("HttpOnly") or "httponly" in str(cookie._rest).lower() else "?"
        print(f"  {cookie.name}: Secure={secure} HttpOnly={httponly} Domain={cookie.domain}")
    if not cookies:
        print("  (No cookies set on initial request — check after login)")

    # ── Summary score ─────────────────────────────────────────────
    header_score = sum(results.get("headers", {}).values())
    total_score  = trust_score + header_score
    max_score    = len(trust_checks) + len(security_headers)

    print(f"\n{'='*40}")
    print(f"OVERALL SCORE: {total_score}/{max_score}")
    print(f"  Security headers: {header_score}/6")
    print(f"  Trust signals:    {trust_score}/9")

    if total_score >= 12:   print("Rating: GOOD ✓")
    elif total_score >= 8:  print("Rating: FAIR ⚠")
    else:                   print("Rating: POOR ✗")

    return results


if __name__ == "__main__":
    import sys
    url = sys.argv[1] if len(sys.argv) > 1 else "https://example-store.com"
    audit_site(url)