rapid7/metasploit-framework — pull request #1863 by mandreko (2013-05-23 19:09:48+00:00)
Title: Fixed a bug in the HSTS module around null headers

A colleague discovered that if an HTTPS server did not return any headers, this module would fail.

An example would be:

$ curl -I -k https://11.22.33.44
curl: (52) Empty reply from server

This would cause the error in the module:

msf auxiliary(http_hsts) > rexploit
[*] Reloading module...

[*] 11.22.33.44:443:
[-] Auxiliary failed: NoMethodError undefined method `headers' for nil:NilClass
[-] Call stack:
[-] /usr/local/share/metasploit-framework/modules/auxiliary/scanner/http/http_hsts.rb:39:in `run_host'
[-] /usr/local/share/metasploit-framework/lib/msf/core/auxiliary/scanner.rb:94:in `block in run'
[-] /usr/local/share/metasploit-framework/lib/msf/core/thread_manager.rb:100:in `call'
[-] /usr/local/share/metasploit-framework/lib/msf/core/thread_manager.rb:100:in `block in spawn'
[*] Auxiliary module execution completed

To fix this, I just made sure to check that the response was not nil before trying to read the HSTS header.