#!/usr/bin/env python3
"""Basic HTTP-header assessment using DeepSeek V4.1 Flash via Strata.
Usage: python3 deepseek_security_demo.py https://example.com
Optional: STRATA_BASE_URL (defaults to http://127.0.0.1:8080/v1)
STRATA_API_KEY (for authenticated endpoints)
STRATA_MODEL (defaults to the first ID returned by /v1/models)
Uses Python standard library only. Not an active penetration test.
"""
import datetime as dt
import getpass
import html
import json
import os
import re
import subprocess
import sys
import time
import urllib.error
import urllib.request
from pathlib import Path
from urllib.parse import urlsplit
API_BASE = os.environ.get('STRATA_BASE_URL', 'http://127.0.0.1:8080/v1').rstrip('/')
CHECKS = [
('Strict-Transport-Security', 'HSTS', 'Enforces HTTPS connections'),
('Content-Security-Policy', 'Content Security Policy', 'Limits what resources can execute'),
('X-Content-Type-Options', 'Content Type Protection', 'Prevents content-type sniffing'),
('Referrer-Policy', 'Referrer Policy', 'Controls referrer data disclosure'),
('Permissions-Policy', 'Permissions Policy', 'Restricts browser capabilities'),
]
def fetch_headers(url):
req = urllib.request.Request(url, method='HEAD', headers={'User-Agent': 'Mozilla/5.0 (compatible; LiveHeaderAudit/1.0)'})
try:
with urllib.request.urlopen(req, timeout=20) as res:
return res.status, dict(res.headers.items()), res.url
except urllib.error.HTTPError as err:
if err.code in (405, 501): # Some sites do not support HEAD.
fallback = urllib.request.Request(
url, method='GET', headers={'User-Agent': 'Mozilla/5.0 (compatible; LiveHeaderAudit/1.0)'}
)
with urllib.request.urlopen(fallback, timeout=20) as res:
return res.status, dict(res.headers.items()), res.url
return err.code, dict(err.headers.items()), url
def authorization_headers(api_key):
return {'Authorization': f'Bearer {api_key}'} if api_key else {}
def model_name(api_key):
configured = os.environ.get('STRATA_MODEL')
if configured:
return configured
request = urllib.request.Request(
API_BASE + '/models', headers=authorization_headers(api_key)
)
with urllib.request.urlopen(request, timeout=20) as response:
models = json.load(response).get('data', [])
if not models:
raise ValueError('No model returned by /v1/models')
return models[0]['id']
def ask_model(api_key, model, status, headers, url):
lower = {k.lower(): v for k, v in headers.items()}
selected = '\n'.join(
f'{key}: {lower.get(key.lower(), "MISSING")[:120]}'
for key, _, _ in CHECKS
)
prompt = (
'Analyze only HTTP response headers for a basic defensive audit. '
'Give 3 very short lines, each SEVERITY | Finding | Fix. '
'SEVERITY must be HIGH, MEDIUM, or INFO. '
'Discuss only facts supported by headers. Missing header is not proof of exploitable vulnerability. '
'Each finding and fix must be 7 words or fewer. No markdown.\n'
f'Website: {url}\nHTTP status: {status}\nHeaders:\n{selected}'
)
body = json.dumps({
'model': model,
'messages': [{'role': 'user', 'content': prompt}],
'reasoning_effort': 'none',
'max_tokens': 100,
'stream': False,
}).encode('utf-8')
req = urllib.request.Request(API_BASE + '/chat/completions', data=body, headers={
'Content-Type': 'application/json', **authorization_headers(api_key)
}, method='POST')
with urllib.request.urlopen(req, timeout=900) as res:
reply = json.load(res)
return reply['choices'][0]['message'].get('content', '').strip(), reply.get('usage', {})
def parse_findings(text):
findings = []
for line in text.splitlines():
line = re.sub(r'^\s*[-*0-9.)]+\s*', '', line.strip())
parts = [p.strip(' *') for p in line.split('|')]
if len(parts) >= 3:
sev = parts[0].upper()
if sev not in {'HIGH', 'MEDIUM', 'INFO'}:
sev = 'INFO'
findings.append((sev, parts[1][:100], ' | '.join(parts[2:])[:180]))
if findings:
return findings[:3]
# If the LLM ignores line formatting, still show the actual text instead of losing the demo.
return [('INFO', 'DeepSeek assessment', (text or 'No assessment text returned.')[:900])]
def render(url, status, headers, findings, raw_answer, elapsed, model):
low = {k.lower(): v for k, v in headers.items()}
results = []
for key, title, desc in CHECKS:
exists = key.lower() in low
results.append((title, desc, exists))
score = int(100 * sum(ok for _, _, ok in results) / len(results))
safe = lambda s: html.escape(str(s), quote=True)
cards = ''.join(
f'{safe(title)}'
f'{"PRESENT" if present else "MISSING"}
'
f'
{safe(desc)}
| {safe(k)} | {safe("[redacted]" if k.lower() in {"set-cookie", "authorization"} else v)} |
'
for k, v in headers.items()
)
grade = 'good' if score >= 80 else 'caution' if score >= 40 else 'risk'
timestamp = dt.datetime.now().astimezone().strftime('%b %d, %Y · %I:%M %p %Z')
return f'''
DeepSeek / Live Security Audit
◆ DEEPSEEK V4.1 FLASH / STRATA
AUDIT COMPLETE
REAL WEBSITE DATA · AI-ASSISTED REVIEW
Security Header Audit
{safe(url)}
01 / LIVE TARGET
HTTP STATUS{status}
HEADERS INSPECTED{len(headers)}
AI ENGINE{safe(model)}
{score}/100
HEADER PRESENCE SCORE
02 / SECURITY CONTROLS
{cards}03 / DEEPSEEK FINDINGS
{findings_html}
Scope: basic HTTP response-header checks only. The score measures presence of five defensive headers, not overall website security. Missing headers do not establish an exploitable vulnerability. No active penetration test was performed.
Show raw HTTP response headers