How this checker works
The HTTP2SHELL checker sends ordinary HTTPS GET requests to the host a visitor enters and reads the response headers. It never sends payloads, POST requests, or exploit, crash or timing probes, and it discards response bodies unread.
Identifying our requests
- User-Agent:
ZEST-Security-Exposure-Check/1.0 (+https://exposure.sh; security@zestsecurity.io) - Each check sends at most three probe GETs, and stops early once it has an answer. For HTTP2SHELL: the page entered,
/index.php, and one random file name ending in.phpthat does not exist. Each probe follows at most two redirects within the same host or its www twin. - If the site refuses every one of those identified requests, the same probes are retried once with standard browser request headers, because some CDNs refuse automated clients from cloud networks. The result says when this happened.
- A path other than
/adds one GET for the ownership file/.well-known/zest-exposure.txt, and is checked only when that file holds the token we issued. - Each host can be checked at most once per 10-minute window, and the total number of checks per day is capped.
Opting out
- Email security@zestsecurity.io with the hostnames to exclude. An opt-out covers subdomains and every exposure.sh checker.
What a result means
- Results are version-based triage. A version header can be hidden, stale or spoofed, and it does not show vendor backports or every server behind a hostname.
- Owners can paste the output of read-only commands on the results page. That output is evaluated in the browser and is not sent to ZEST.