Finding All Insecure Content on a Secure Page

Question

What's the most efficient way to find a list of all non-HTTPS URLs requested by an HTTPS page? If this kind of security violation happens, every browser alerts the user, but I can't find an easy way to find what exact URLs cause the violation.

The easiest way I've found so far is to use Firefox, but even then it's still not very convenient. First, I can right-click, select View Page Info, click the Media tab, and scroll through a list of URLs. However, this seems to only list image files, not CSS or JS includes that can also cause the error. For those, I have to use the Firebug extension, select the Net tab, and manually hover my mouse over each item to see the entire URL. Unfortunately, this can take a while if you have dozens of media files. Is there a better way?

Answer 1

Use Fiddler.

Secure requests won't show up at all (except as HTTPS CONNECTs, which can be hidden), so everything you'll see is bad.

Answer 2

You can use SslCheck

It's a free online tool that crawls a website recursively (following all internal links) and scans for unsecure content - images, scripts and CSS.

(disclaimer: I'm one of the developers)

Answer 3

I had this problem which occurred in a javascript:

/* for Internet Explorer */
/*@cc_on @*/
/*@if (@_win32)
    document.write("<script id=__ie_onload defer src=javascript:void(0)><\/script>");
(.....)

The src=javascript:void(0) should be avoided.

You can not find this problem using Fiddler or Chrome.

Answer 4

Use Burp Suite, set up the scope as your website, browse to the secure page and check which request are made to HTTP version of your website.

Answer 5

I just want to leave a note about what happened to me when this problem arose.

Suddenly my domain showed 'Mixed: Insecure Items'. I couldn't find the cause at all. The console was just showing an image was being requested: http://www.example.com/, Which I could not find any reference to anywhere.

I searched and searched and eventually found that in the Security Tab of Chrome, Where it was displaying 'Insecure Content' it said 'Show in Network Tab'. When I clicked that, It was showing me the bad URL, again, with no information apart from the Initiatior column. It was showing the image footer_bg.jpg.

Had someone injected code into my footer background image I wondered? Turns out no, I had inadvertently moved that image yesterday and forgot about it. So the page was requesting an image that wasn't there, returning an error. I fixed the link to the image and page loads securely again.

Just for anyone else that will possibly have this problem in the future.

Answer 6

Try: www.WhyNoPadlock.com It will give you a report of all insecure content on any https web page.