mirror of
https://github.com/drwetter/testssl.sh.git
synced 2025-01-03 23:39:45 +01:00
Merge branch 'master' into uppercase-severity-codes
This commit is contained in:
John Carver
commit
87218b6b1a
11
Readme.md
11
Readme.md
@ -45,11 +45,18 @@ Done so far:
|
||||
* Even more compatibilty improvements for FreeBSD, RH-ish and F5 systems
|
||||
* OpenSSL 1.1.0 compliant
|
||||
|
||||
Contributions, feedback, also bug reports are welcome! For contributions please note: One patch per feature -- bug fix/improvement. Please test your changes thouroughly as reliability is important for this project.
|
||||
Update notification here or @ [twitter](https://twitter.com/drwetter).
|
||||
|
||||
####Contributions
|
||||
Contributions, feedback, bug reports are welcome! For contributions please note: One patch per feature -- bug fix/improvement. Please test your changes thouroughly as reliability is important for this project.
|
||||
|
||||
There's [coding guide line](https://github.com/drwetter/testssl.sh/wiki/Coding-Style).
|
||||
|
||||
Please file bug reports @ https://github.com/drwetter/testssl.sh/issues .
|
||||
|
||||
Update notification here or @ [twitter](https://twitter.com/drwetter).
|
||||
####Documentation
|
||||
|
||||
For a start see the [wiki](https://github.com/drwetter/testssl.sh/wiki/Usage-Documentation). Help is needed here.
|
||||
|
||||
----
|
||||
|
||||
|
||||
62
testssl.sh
62
testssl.sh
@ -720,7 +720,7 @@ run_http_header() {
|
||||
301|302|307|308)
|
||||
redirect=$(grep -a '^Location' $HEADERFILE | sed 's/Location: //' | tr -d '\r\n')
|
||||
out ", redirecting to \"$redirect\""
|
||||
if [[ $redirect != "https://"* ]]; then
|
||||
if [[ $redirect == "http://"* ]]; then
|
||||
pr_litered " -- Redirect to insecure URL (NOT ok)"
|
||||
fileout "status_code" "NOT OK" \, "Redirect to insecure URL (NOT ok). Url: \"$redirect\""
|
||||
fi
|
||||
@ -985,10 +985,13 @@ run_hpkp() {
|
||||
fileout "hpkp_preload" "INFO" "HPKP header is NOT marked for browser preloading"
|
||||
fi
|
||||
|
||||
[[ -s "$HOSTCERT" ]] || get_host_cert
|
||||
# get the key fingerprints
|
||||
if [[ ! -s "$HOSTCERT" ]]; then
|
||||
get_host_cert || return 1
|
||||
fi
|
||||
# get the key fingerprint from the host certificate
|
||||
hpkp_key_hostcert="$($OPENSSL x509 -in $HOSTCERT -pubkey -noout | grep -v PUBLIC | \
|
||||
$OPENSSL base64 -d | $OPENSSL dgst -sha256 -binary | $OPENSSL base64)"
|
||||
# compare it with the ones provided in the header
|
||||
while read hpkp_key; do
|
||||
if [[ "$hpkp_key_hostcert" == "$hpkp_key" ]] || [[ "$hpkp_key_hostcert" == "$hpkp_key=" ]]; then
|
||||
out "\n$spaces matching host key: "
|
||||
@ -2626,14 +2629,16 @@ cipher_pref_check() {
|
||||
get_host_cert() {
|
||||
local tmpvar=$TEMPDIR/$FUNCNAME.txt # change later to $TMPFILE
|
||||
|
||||
$OPENSSL s_client $STARTTLS $BUGS -connect $NODEIP:$PORT $PROXY $SNI $1 2>/dev/null </dev/null >$tmpdir
|
||||
$OPENSSL s_client $STARTTLS $BUGS -connect $NODEIP:$PORT $PROXY $SNI $1 2>/dev/null </dev/null >$tmpvar
|
||||
if sclient_connect_successful $? $tmpvar; then
|
||||
awk '/-----BEGIN/,/-----END/ { print $0 }' $tmpvar >$HOSTCERT
|
||||
return 0
|
||||
else
|
||||
pr_litemagentaln "could not retrieve host certificate!"
|
||||
return 1
|
||||
fi
|
||||
tmpfile_handle $FUNCNAME.txt
|
||||
# return $((${PIPESTATUS[0]} + ${PIPESTATUS[1]}))
|
||||
#tmpfile_handle $FUNCNAME.txt
|
||||
#return $((${PIPESTATUS[0]} + ${PIPESTATUS[1]}))
|
||||
}
|
||||
|
||||
verify_retcode_helper() {
|
||||
@ -3399,7 +3404,7 @@ run_server_defaults() {
|
||||
# http://www.heise.de/security/artikel/Forward-Secrecy-testen-und-einrichten-1932806.html
|
||||
run_pfs() {
|
||||
local -i sclient_success
|
||||
local -i pfs_offered=1
|
||||
local pfs_offered=false
|
||||
local tmpfile
|
||||
local dhlen
|
||||
local hexcode dash pfs_cipher sslvers kx auth enc mac
|
||||
@ -3431,12 +3436,12 @@ run_pfs() {
|
||||
pr_brownln "Not OK: No ciphers supporting Forward Secrecy offered"
|
||||
fileout "pfs" "NOT OK" "(Perfect) Forward Secrecy : Not OK: No ciphers supporting Forward Secrecy offered"
|
||||
else
|
||||
pfs_offered=0
|
||||
pfs_offered=true
|
||||
pfs_ciphers=""
|
||||
pr_litegreen " PFS is offered (OK)"
|
||||
fileout "pfs" "OK" "(Perfect) Forward Secrecy : PFS is offered (OK)"
|
||||
if $WIDE; then
|
||||
outln ", ciphers follow (client/browser support is here specially important) \n"
|
||||
outln ", ciphers follow (client/browser support is important here) \n"
|
||||
neat_header
|
||||
else
|
||||
out " "
|
||||
@ -3446,7 +3451,8 @@ run_pfs() {
|
||||
$OPENSSL s_client -cipher $pfs_cipher $STARTTLS $BUGS -connect $NODEIP:$PORT $PROXY $SNI &>$tmpfile </dev/null
|
||||
sclient_connect_successful $? $tmpfile
|
||||
sclient_success=$?
|
||||
if [[ $sclient_success -ne 0 ]] && [[ "$SHOW_EACH_C" -eq 0 ]]; then
|
||||
[[ "$sclient_success" -eq 0 ]] && pfs_offered=true
|
||||
if [[ "$sclient_success" -ne 0 ]] && [[ "$SHOW_EACH_C" -eq 0 ]]; then
|
||||
continue # no successful connect AND not verbose displaying each cipher
|
||||
fi
|
||||
if $WIDE; then
|
||||
@ -3456,7 +3462,6 @@ run_pfs() {
|
||||
kx="$kx $dhlen"
|
||||
fi
|
||||
neat_list $HEXC $pfs_cipher "$kx" $enc $strength
|
||||
let "pfs_offered++"
|
||||
if [[ "$SHOW_EACH_C" -ne 0 ]]; then
|
||||
if [[ $sclient_success -eq 0 ]]; then
|
||||
pr_green "works"
|
||||
@ -3474,7 +3479,7 @@ run_pfs() {
|
||||
debugme echo $pfs_offered
|
||||
$WIDE || outln
|
||||
|
||||
if [[ "$pfs_offered" -eq 1 ]]; then
|
||||
if ! "$pfs_offered"; then
|
||||
pr_brown "no PFS ciphers found"
|
||||
fileout "pfs_ciphers" "NOT OK" "(Perfect) Forward Secrecy Ciphers: no PFS ciphers found (NOT ok)"
|
||||
else
|
||||
@ -3488,7 +3493,11 @@ run_pfs() {
|
||||
|
||||
tmpfile_handle $FUNCNAME.txt
|
||||
# sub1_curves
|
||||
return $pfs_offered
|
||||
if "$pfs_offered"; then
|
||||
return 0
|
||||
else
|
||||
return 1
|
||||
fi
|
||||
}
|
||||
|
||||
|
||||
@ -4930,9 +4939,11 @@ run_beast(){
|
||||
local continued=false
|
||||
local cbc_cipher_list="EXP-RC2-CBC-MD5:IDEA-CBC-SHA:EXP-DES-CBC-SHA:DES-CBC-SHA:DES-CBC3-SHA:EXP-DH-DSS-DES-CBC-SHA:DH-DSS-DES-CBC-SHA:DH-DSS-DES-CBC3-SHA:EXP-DH-RSA-DES-CBC-SHA:DH-RSA-DES-CBC-SHA:DH-RSA-DES-CBC3-SHA:EXP-EDH-DSS-DES-CBC-SHA:EDH-DSS-DES-CBC-SHA:EDH-DSS-DES-CBC3-SHA:EXP-EDH-RSA-DES-CBC-SHA:EDH-RSA-DES-CBC-SHA:EDH-RSA-DES-CBC3-SHA:EXP-ADH-DES-CBC-SHA:ADH-DES-CBC-SHA:ADH-DES-CBC3-SHA:KRB5-DES-CBC-SHA:KRB5-DES-CBC3-SHA:KRB5-IDEA-CBC-SHA:KRB5-DES-CBC-MD5:KRB5-DES-CBC3-MD5:KRB5-IDEA-CBC-MD5:EXP-KRB5-DES-CBC-SHA:EXP-KRB5-RC2-CBC-SHA:EXP-KRB5-DES-CBC-MD5:EXP-KRB5-RC2-CBC-MD5:AES128-SHA:DH-DSS-AES128-SHA:DH-RSA-AES128-SHA:DHE-DSS-AES128-SHA:DHE-RSA-AES128-SHA:ADH-AES128-SHA:AES256-SHA:DH-DSS-AES256-SHA:DH-RSA-AES256-SHA:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:ADH-AES256-SHA:AES128-SHA256:AES256-SHA256:DH-DSS-AES128-SHA256:DH-RSA-AES128-SHA256:DHE-DSS-AES128-SHA256:CAMELLIA128-SHA:DH-DSS-CAMELLIA128-SHA:DH-RSA-CAMELLIA128-SHA:DHE-DSS-CAMELLIA128-SHA:DHE-RSA-CAMELLIA128-SHA:ADH-CAMELLIA128-SHA:EXP1024-DES-CBC-SHA:EXP1024-DHE-DSS-DES-CBC-SHA:DHE-RSA-AES128-SHA256:DH-DSS-AES256-SHA256:DH-RSA-AES256-SHA256:DHE-DSS-AES256-SHA256:DHE-RSA-AES256-SHA256:ADH-AES128-SHA256:ADH-AES256-SHA256:CAMELLIA256-SHA:DH-DSS-CAMELLIA256-SHA:DH-RSA-CAMELLIA256-SHA:DHE-DSS-CAMELLIA256-SHA:DHE-RSA-CAMELLIA256-SHA:ADH-CAMELLIA256-SHA:PSK-3DES-EDE-CBC-SHA:PSK-AES128-CBC-SHA:PSK-AES256-CBC-SHA:SEED-SHA:DH-DSS-SEED-SHA:DH-RSA-SEED-SHA:DHE-DSS-SEED-SHA:DHE-RSA-SEED-SHA:ADH-SEED-SHA:ECDH-ECDSA-DES-CBC3-SHA:ECDH-ECDSA-AES128-SHA:ECDH-ECDSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA:ECDH-RSA-DES-CBC3-SHA:ECDH-RSA-AES128-SHA:ECDH-RSA-AES256-SHA:ECDHE-RSA-DES-CBC3-SHA:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-SHA:AECDH-DES-CBC3-SHA:AECDH-AES128-SHA:AECDH-AES256-SHA:SRP-3DES-EDE-CBC-SHA:SRP-RSA-3DES-EDE-CBC-SHA:SRP-DSS-3DES-EDE-CBC-SHA:SRP-AES-128-CBC-SHA:SRP-RSA-AES-128-CBC-SHA:SRP-DSS-AES-128-CBC-SHA:SRP-AES-256-CBC-SHA:SRP-RSA-AES-256-CBC-SHA:SRP-DSS-AES-256-CBC-SHA:ECDHE-ECDSA-AES128-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDH-ECDSA-AES128-SHA256:ECDH-ECDSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA384:ECDH-RSA-AES128-SHA256:ECDH-RSA-AES256-SHA384:RC2-CBC-MD5:EXP-RC2-CBC-MD5:IDEA-CBC-MD5:DES-CBC-MD5:DES-CBC3-MD5"
|
||||
|
||||
if [[ $VULN_COUNT -le $VULN_THRESHLD ]] || "$WIDE"; then
|
||||
if [[ $VULN_COUNT -le $VULN_THRESHLD ]]; then
|
||||
outln
|
||||
pr_headlineln " Testing for BEAST vulnerability "
|
||||
fi
|
||||
if [[ $VULN_COUNT -le $VULN_THRESHLD ]] || "$WIDE"; then
|
||||
outln
|
||||
fi
|
||||
pr_bold " BEAST"; out " (CVE-2011-3389) "
|
||||
@ -4968,8 +4979,10 @@ run_beast(){
|
||||
sclient_connect_successful $? $TMPFILE || continue
|
||||
|
||||
if "$WIDE"; then
|
||||
outln "\n $(toupper $proto):";
|
||||
neat_header # NOT_THAT_NICE: we display the header also if in the end no cbc cipher is available on the client side
|
||||
out "\n "; pr_underline "$(toupper $proto):\n";
|
||||
if "$first"; then
|
||||
neat_header # NOT_THAT_NICE: we display the header also if in the end no cbc cipher is available on the client side
|
||||
fi
|
||||
fi
|
||||
for ciph in $(colon_to_spaces "$cbc_cipher_list"); do
|
||||
read hexcode dash cbc_cipher sslvers kx auth enc mac < <($OPENSSL ciphers -V "$ciph" 2>>$ERRFILE) # -V doesn't work with openssl < 1.0
|
||||
@ -4977,7 +4990,7 @@ run_beast(){
|
||||
$OPENSSL s_client -cipher "$cbc_cipher" -"$proto" $STARTTLS $BUGS -connect $NODEIP:$PORT $PROXY $SNI >$TMPFILE 2>>$ERRFILE </dev/null
|
||||
sclient_connect_successful $? $TMPFILE
|
||||
sclient_success=$?
|
||||
[[ $sclient_success -eq 0 ]] && vuln_beast=true
|
||||
[[ $sclient_success -eq 0 ]] && vuln_beast=true && "$WIDE" && first=false
|
||||
if "$WIDE"; then
|
||||
normalize_ciphercode $hexcode
|
||||
if [[ "$SHOW_EACH_C" -ne 0 ]]; then
|
||||
@ -5003,7 +5016,11 @@ run_beast(){
|
||||
|
||||
if ! "$WIDE"; then
|
||||
if [[ -n "$detected_cbc_ciphers" ]]; then
|
||||
detected_cbc_ciphers=$(echo "$detected_cbc_ciphers" | sed -e "s/ /\\${cr} ${spaces}/9" -e "s/ /\\${cr} ${spaces}/6" -e "s/ /\\${cr} ${spaces}/3")
|
||||
detected_cbc_ciphers=$(echo "$detected_cbc_ciphers" | \
|
||||
sed -e "s/ /\\${cr} ${spaces}/12" \
|
||||
-e "s/ /\\${cr} ${spaces}/9" \
|
||||
-e "s/ /\\${cr} ${spaces}/6" \
|
||||
-e "s/ /\\${cr} ${spaces}/3")
|
||||
fileout "cbc_$proto" "NOT OK" "BEAST (CVE-2011-3389) : CBC ciphers for $(toupper $proto): $detected_cbc_ciphers"
|
||||
! "$first" && out "$spaces"
|
||||
out "$(toupper $proto):"
|
||||
@ -5075,16 +5092,18 @@ run_rc4() {
|
||||
local rc4_detected=""
|
||||
local available=""
|
||||
|
||||
if [[ $VULN_COUNT -le $VULN_THRESHLD ]] || $WIDE; then
|
||||
if [[ $VULN_COUNT -le $VULN_THRESHLD ]]; then
|
||||
outln
|
||||
pr_headlineln " Checking for vulnerable RC4 Ciphers "
|
||||
fi
|
||||
if [[ $VULN_COUNT -le $VULN_THRESHLD ]] || "$WIDE"; then
|
||||
outln
|
||||
fi
|
||||
pr_bold " RC4"; out " (CVE-2013-2566, CVE-2015-2808) "
|
||||
|
||||
$OPENSSL s_client -cipher $rc4_ciphers_list $STARTTLS $BUGS -connect $NODEIP:$PORT $PROXY $SNI >$TMPFILE 2>$ERRFILE </dev/null
|
||||
if sclient_connect_successful $? $TMPFILE; then
|
||||
pr_litered "VULNERABLE (NOT ok): "
|
||||
"$WIDE" || pr_litered "VULNERABLE (NOT ok): "
|
||||
rc4_offered=1
|
||||
if "$WIDE"; then
|
||||
outln "\n"
|
||||
@ -5118,6 +5137,7 @@ run_rc4() {
|
||||
rc4_detected+="$rc4_cipher "
|
||||
done < <($OPENSSL ciphers -V $rc4_ciphers_list:@STRENGTH)
|
||||
outln
|
||||
"$WIDE" && pr_litered "VULNERABLE (NOT ok)"
|
||||
fileout "rc4" "NOT OK" "RC4 (CVE-2013-2566, CVE-2015-2808) : VULNERABLE (NOT ok) Detected ciphers: $rc4_detected"
|
||||
else
|
||||
pr_litegreenln "no RC4 ciphers detected (OK)"
|
||||
@ -6760,4 +6780,4 @@ fi
|
||||
exit $?
|
||||
|
||||
|
||||
# $Id: testssl.sh,v 1.464 2016/02/07 18:13:58 dirkw Exp $
|
||||
# $Id: testssl.sh,v 1.467 2016/02/22 09:44:42 dirkw Exp $
|
||||
|
||||
Loading…
Reference in New Issue
Block a user