Why Kali Linux for AMP Analysis?
AMP pages are built for speed, but their dependency on external caches and strict HTML rules creates specific security and performance risks. Kali Linux, with its collection of network and web analysis tools, gives you the command-line power to inspect AMP pages server-side, verify cache behavior, and catch misconfigurations before they affect users. This article covers practical, defensive commands to audit AMP implementations without crossing into attack territory.
Essential Commands for AMP Page Inspection
1. curl – Peek at Headers and Content
The curl command is your first line of defense when analyzing any web page—AMP pages are no exception. Use curl -I to fetch only the HTTP response headers. For an AMP page, look for the Link header that points to the AMP cache version (e.g., Link: ; rel="amphtml"). This confirms the page is properly linked to its cache counterpart.
curl -I To see the full HTML and verify the required <html amp> attribute and the <script async src="; tag, pipe the output to grep:
curl -s | grep -i 'amp'If you suspect mixed content (HTTP resources on an HTTPS AMP page), curl can list all external resources by parsing the HTML. Combine with grep -oP to extract URLs and check their scheme.
2. wget – Mirror and Validate
For a deeper audit, wget can recursively download an AMP page and its dependencies. Use the --spider flag to check links without downloading files:
wget --spider --force-html -r -l2 This command follows links up to two levels deep and reports broken or blocked resources. Pay attention to any 404 or 403 errors that might indicate missing AMP components or blocked scripts.
3. openssl s_client – Verify TLS Strength
AMP pages must be served over HTTPS to be cached and displayed correctly. Use openssl s_client to examine the TLS certificate chain and cipher suite:
echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -text | grep -E "Subject:|Issuer:|Not After"Check that the certificate is valid and issued by a trusted CA. Weak ciphers (e.g., RC4, 3DES) degrade performance and security—AMP caches may reject connections using outdated protocols.
Network Diagnostics for AMP Traffic
4. tcpdump – Capture AMP Cache Requests
When debugging why an AMP page isn't loading from the cache, tcpdump lets you inspect the actual network packets. Filter for traffic to and from the AMP cache domain (e.g., cdn.ampproject.org):
sudo tcpdump -i eth0 host cdn.ampproject.org -w amp-cache.pcapOpen the resulting .pcap file in Wireshark or analyze it directly with tcpdump -r to see HTTP request and response details. Look for redirect loops or cache miss headers (X-Cache: MISS).
5. nmap – Scan AMP Cache Endpoints
While you should never scan systems you don't own, you can use nmap against your own AMP cache infrastructure or a local test server. The -sV flag identifies service versions running on cache endpoints:
nmap -sV -p 80,443 cdn.ampproject.orgImportant: This command is shown only for educational purposes and should be run against your own servers or in a lab environment. Unauthorized scanning is illegal.
6. whatweb – Fingerprint AMP Technologies
Kali includes whatweb, a tool that recognizes web technologies. Run it against your AMP page to see which AMP components are detected:
whatweb The output lists detected plugins, libraries, and headers. If you see an unexpected technology (e.g., a non-AMP JavaScript framework), it may indicate a broken AMP implementation.
Security-Focused Commands for AMP Pages
7. nikto – Lightweight Vulnerability Scan
nikto can perform a quick scan for common web vulnerabilities on your AMP origin server. Use the -ssl flag for HTTPS and -Tuning to limit checks to safe categories:
nikto -h -ssl -Tuning 123Focus on findings related to information disclosure, missing security headers, or outdated server software. AMP pages rely on strict CSP (Content Security Policy) headers—nikto will report if they are absent.
8. testssl.sh – Deep SSL/TLS Audit
For a thorough check of your AMP page's HTTPS configuration, testssl.sh (available in Kali under /usr/bin/testssl.sh) provides a detailed report:
testssl.sh --quiet --protocols Look for warnings about weak Diffie-Hellman parameters or missing HSTS headers. AMP caches require HSTS to serve content securely; without it, users may be downgraded to HTTP.
Practical Workflow: Auditing an AMP Page
Combine these commands into a repeatable audit. For example, start with curl to verify the AMP cache link and required tags. Then use wget --spider to check for broken resources. Run tcpdump while loading the page in a browser to see real-time requests. Finally, scan the origin server with nikto and testssl.sh to catch configuration gaps. Document every finding in a markdown file for later remediation.
If you encounter an ERR_NETWORK_CHANGED error while testing AMP pages in Chrome, our detailed guide on Fixing ERR_NETWORK_CHANGED in Chrome for AMP Pages: Causes and Solutions explains how to diagnose network fluctuations that interfere with AMP cache connections.
Automating AMP Health Checks
Set up a simple shell script that runs daily from a cron job. The script can use curl to fetch your AMP page and check for the presence of the amphtml link header, then log the result to a file. If the header is missing, send an alert. This proactive monitoring keeps your AMP pages accessible and secure without manual effort.
#!/bin/bash
URL=";
HEADER=$(curl -sI "$URL" | grep -i "amphtml")
if [ -z "$HEADER" ]; then
echo "$(date): Missing amphtml link header on $URL" >> /var/log/amp-audit.log
fi
