mirror of
https://github.com/drwetter/testssl.sh.git
synced 2025-09-18 01:42:54 +02:00
Merge branch '3.1dev' into socksend_cleanup
This commit is contained in:
Dirk Wetter
@ -20,8 +20,8 @@ my $uri="google.com";
|
||||
my $socket_out="";
|
||||
my $openssl_out="";
|
||||
# Blacklists we use to trigger an error:
|
||||
my $socket_regex_bl='(e|E)rror|\.\/testssl\.sh: line |(f|F)atal';
|
||||
my $openssl_regex_bl='(e|E)rror|(f|F)atal|\.\/testssl\.sh: line |Oops|s_client connect problem';
|
||||
my $socket_regex_bl='(e|E)rror|\.\/testssl\.sh: line |(f|F)atal|(c|C)ommand not found';
|
||||
my $openssl_regex_bl='(e|E)rror|(f|F)atal|\.\/testssl\.sh: line |Oops|s_client connect problem|(c|C)ommand not found';
|
||||
my $json_regex_bl='(id".*:\s"scanProblem"|severity".*:\s"FATAL"|"Scan interrupted")';
|
||||
|
||||
my $socket_json="";
|
||||
@ -20,8 +20,8 @@ my $uri="";
|
||||
my $socket_out="";
|
||||
my $openssl_out="";
|
||||
# Blacklists we use to trigger an error:
|
||||
my $socket_regex_bl='(e|E)rror|\.\/testssl\.sh: line |(f|F)atal';
|
||||
my $openssl_regex_bl='(e|E)rror|(f|F)atal|\.\/testssl\.sh: line |Oops|s_client connect problem';
|
||||
my $socket_regex_bl='(e|E)rror|\.\/testssl\.sh: line |(f|F)atal|(c|C)ommand not found';
|
||||
my $openssl_regex_bl='(e|E)rror|(f|F)atal|\.\/testssl\.sh: line |Oops|s_client connect problem|(c|C)ommand not found';
|
||||
|
||||
# my $socket_json="";
|
||||
# my $openssl_json="";
|
||||
@ -17,14 +17,14 @@ use Data::Dumper;
|
||||
|
||||
my $tests = 0;
|
||||
my $prg="./testssl.sh";
|
||||
my $check2run_smtp="--protocols --standard --fs --server-preference --headers --vulnerable --each-cipher -q --ip=one --color 0";
|
||||
my $check2run_smtp="--protocols --standard --fs --server-preference --headers --vulnerable -q --ip=one --color 0";
|
||||
my $check2run="-q --ip=one --color 0";
|
||||
my $uri="";
|
||||
my $socket_out="";
|
||||
my $openssl_out="";
|
||||
# Blacklists we use to trigger an error:
|
||||
my $socket_regex_bl='(e|E)rror|\.\/testssl\.sh: line |(f|F)atal';
|
||||
my $openssl_regex_bl='(e|E)rror|(f|F)atal|\.\/testssl\.sh: line |Oops|s_client connect problem';
|
||||
my $socket_regex_bl='(e|E)rror|\.\/testssl\.sh: line |(f|F)atal|(c|C)ommand not found';
|
||||
my $openssl_regex_bl='(e|E)rror|(f|F)atal|\.\/testssl\.sh: line |Oops|s_client connect problem|(c|C)ommand not found';
|
||||
|
||||
# my $socket_json="";
|
||||
# my $openssl_json="";
|
||||
@ -60,12 +60,14 @@ $socket_out = `./testssl.sh $check2run -t pop3 $uri 2>&1`;
|
||||
unlike($socket_out, qr/$socket_regex_bl/, "");
|
||||
$tests++;
|
||||
|
||||
# commented out, bc of travis' limits
|
||||
#
|
||||
#printf "\n%s\n", "STARTTLS POP3 unit tests via OpenSSL --> $uri ...";
|
||||
# unlink "tmp.json";
|
||||
printf "\n%s\n", "STARTTLS POP3 unit tests via OpenSSL --> $uri ...";
|
||||
$openssl_out = `./testssl.sh --ssl-native $check2run -t pop3 $uri 2>&1`;
|
||||
#$openssl_out = `./testssl.sh --ssl-native $check2run -t pop3 $uri 2>&1`;
|
||||
# $openssl_json = json('tmp.json');
|
||||
unlike($openssl_out, qr/$openssl_regex_bl/, "");
|
||||
$tests++;
|
||||
#unlike($openssl_out, qr/$openssl_regex_bl/, "");
|
||||
#$tests++;
|
||||
|
||||
|
||||
$uri="imap.gmx.net:143";
|
||||
@ -93,11 +95,13 @@ $socket_out = `./testssl.sh $check2run -t xmpp $uri 2>&1`;
|
||||
unlike($openssl_out, qr/$openssl_regex_bl/, "");
|
||||
$tests++;
|
||||
|
||||
printf "\n%s\n", "STARTTLS XMPP unit tests via OpenSSL --> $uri ...";
|
||||
$openssl_out = `./testssl.sh --ssl-native $check2run -t xmpp $uri 2>&1`;
|
||||
# commented out, bc of travis' limits
|
||||
#
|
||||
#printf "\n%s\n", "STARTTLS XMPP unit tests via OpenSSL --> $uri ...";
|
||||
#$openssl_out = `./testssl.sh --ssl-native $check2run -t xmpp $uri 2>&1`;
|
||||
# $openssl_json = json('tmp.json');
|
||||
unlike($openssl_out, qr/$openssl_regex_bl/, "");
|
||||
$tests++;
|
||||
#unlike($openssl_out, qr/$openssl_regex_bl/, "");
|
||||
#$tests++;
|
||||
|
||||
# $uri="jabber.ccc.de:5269";
|
||||
# printf "\n%s\n", "Quick STARTTLS XMPP S2S unit tests via sockets --> $uri ...";
|
||||
@ -118,13 +122,15 @@ $socket_out =~ s/ error querying OCSP responder .*\n//g;
|
||||
unlike($socket_out, qr/$socket_regex_bl/, "");
|
||||
$tests++;
|
||||
|
||||
printf "\n%s\n", "STARTTLS FTP unit tests via OpenSSL --> $uri ...";
|
||||
$openssl_out = `./testssl.sh --ssl-native $check2run -t ftp $uri 2>&1`;
|
||||
# commented out, bc of travis' limits
|
||||
#
|
||||
# printf "\n%s\n", "STARTTLS FTP unit tests via OpenSSL --> $uri ...";
|
||||
# $openssl_out = `./testssl.sh --ssl-native $check2run -t ftp $uri 2>&1`;
|
||||
# $openssl_json = json('tmp.json');
|
||||
# OCSP stapling fails sometimes with: 'offered, error querying OCSP responder (ERROR: No Status found)'
|
||||
$openssl_out =~ s/ error querying OCSP responder .*\n//g;
|
||||
unlike($openssl_out, qr/$openssl_regex_bl/, "");
|
||||
$tests++;
|
||||
# $openssl_out =~ s/ error querying OCSP responder .*\n//g;
|
||||
# unlike($openssl_out, qr/$openssl_regex_bl/, "");
|
||||
# $tests++;
|
||||
|
||||
|
||||
# https://ldapwiki.com/wiki/Public%20LDAP%20Servers
|
||||
@ -146,11 +152,13 @@ $socket_out = `./testssl.sh $check2run -t nntp $uri 2>&1`;
|
||||
unlike($socket_out, qr/$socket_regex_bl/, "");
|
||||
$tests++;
|
||||
|
||||
printf "\n%s\n", "STARTTLS NNTP unit tests via OpenSSL --> $uri ...";
|
||||
$openssl_out = `./testssl.sh --ssl-native $check2run -t nntp $uri 2>&1`;
|
||||
# commented out, bc of travis' limits
|
||||
#
|
||||
#printf "\n%s\n", "STARTTLS NNTP unit tests via OpenSSL --> $uri ...";
|
||||
#$openssl_out = `./testssl.sh --ssl-native $check2run -t nntp $uri 2>&1`;
|
||||
# $openssl_json = json('tmp.json');
|
||||
unlike($openssl_out, qr/$openssl_regex_bl/, "");
|
||||
$tests++;
|
||||
#unlike($openssl_out, qr/$openssl_regex_bl/, "");
|
||||
#$tests++;
|
||||
|
||||
|
||||
# IRC: missing
|
||||
@ -18,8 +18,8 @@ my $uri="";
|
||||
my $socket_out="";
|
||||
my $openssl_out="";
|
||||
# Blacklists we use to trigger an error:
|
||||
my $socket_regex_bl='(e|E)rror|\.\/testssl\.sh: line |(f|F)atal';
|
||||
my $openssl_regex_bl='(e|E)rror|(f|F)atal|\.\/testssl\.sh: line |Oops|s_client connect problem';
|
||||
my $socket_regex_bl='(e|E)rror|\.\/testssl\.sh: line |(f|F)atal|(c|C)ommand not found';
|
||||
my $openssl_regex_bl='(e|E)rror|(f|F)atal|\.\/testssl\.sh: line |Oops|s_client connect problem|(c|C)ommand not found';
|
||||
|
||||
# my $socket_json="";
|
||||
# my $openssl_json="";
|
||||
@ -53,12 +53,14 @@ $socket_out = `./testssl.sh $check2run -t smtp $uri 2>&1`;
|
||||
unlike($socket_out, qr/$socket_regex_bl/, "");
|
||||
$tests++;
|
||||
|
||||
# commented out, bc of travis' limits
|
||||
#
|
||||
# unlink "tmp.json";
|
||||
printf "\n%s\n", "STARTTLS: Client simulations unit test via OpenSSL --> $uri ...";
|
||||
$openssl_out = `./testssl.sh --ssl-native $check2run -t smtp $uri 2>&1`;
|
||||
# $openssl_json = json('tmp.json');
|
||||
unlike($openssl_out, qr/$openssl_regex_bl/, "");
|
||||
$tests++;
|
||||
#printf "\n%s\n", "STARTTLS: Client simulations unit test via OpenSSL --> $uri ...";
|
||||
#$openssl_out = `./testssl.sh --ssl-native $check2run -t smtp $uri 2>&1`;
|
||||
## $openssl_json = json('tmp.json');
|
||||
#unlike($openssl_out, qr/$openssl_regex_bl/, "");
|
||||
#$tests++;
|
||||
|
||||
done_testing($tests);
|
||||
unlink "tmp.json";
|
||||
|
||||
@ -9,13 +9,13 @@ use JSON;
|
||||
|
||||
my $tests = 0;
|
||||
my $prg="./testssl.sh";
|
||||
my $check2run ="--ip=one -q --color 0";
|
||||
my $check2run ="--ip=one --ids-friendly -q --color 0";
|
||||
my $uri="";
|
||||
my $json="";
|
||||
my $out="";
|
||||
# Blacklists we use to trigger an error:
|
||||
my $socket_regex_bl='(e|E)rror|\.\/testssl\.sh: line |(f|F)atal';
|
||||
my $openssl_regex_bl='(e|E)rror|(f|F)atal|\.\/testssl\.sh: line |Oops|s_client connect problem';
|
||||
my $socket_regex_bl='(e|E)rror|\.\/testssl\.sh: line |(f|F)atal|(c|C)ommand not found';
|
||||
my $openssl_regex_bl='(e|E)rror|(f|F)atal|\.\/testssl\.sh: line |Oops|s_client connect problem|(c|C)ommand not found';
|
||||
|
||||
die "Unable to open $prg" unless -f $prg;
|
||||
|
||||
@ -44,7 +44,7 @@ $tests++;
|
||||
|
||||
|
||||
#3
|
||||
# This testss.sh run deliberately does NOT work as travis-ci.org blocks port 25 egress.
|
||||
# This testssl.sh run deliberately does NOT work as travis-ci.org blocks port 25 egress.
|
||||
# but the output should be fine. The idea is to have a unit test for a failed connection.
|
||||
printf "%s\n", ".. plain JSON for a failed run: '--mx $uri' ...";
|
||||
$out = `./testssl.sh --ssl-native --openssl-timeout=10 $check2run --jsonfile tmp.json --mx $uri`;
|
||||
@ -15,7 +15,7 @@ my $out="";
|
||||
my $html="";
|
||||
my $debughtml="";
|
||||
my $edited_html="";
|
||||
my $check2run="--ip=one --color 0 --htmlfile tmp.html";
|
||||
my $check2run="--ip=one --ids-friendly --color 0 --htmlfile tmp.html";
|
||||
my $diff="";
|
||||
die "Unable to open $prg" unless -f $prg;
|
||||
|
||||
@ -21,7 +21,7 @@ unlink 'tmp.json';
|
||||
|
||||
#1
|
||||
pass(" .. running testssl.sh against badssl.com to create a JSON report with severity level equal greater than LOW (may take 2~3 minutes)"); $tests++;
|
||||
$out = `./testssl.sh -S -e -U --jsonfile tmp.json --severity LOW --color 0 badssl.com`;
|
||||
$out = `./testssl.sh -S -e -U --ids-friendly --jsonfile tmp.json --severity LOW --color 0 badssl.com`;
|
||||
$json = json('tmp.json');
|
||||
unlink 'tmp.json';
|
||||
$found = 0;
|
||||
@ -36,7 +36,7 @@ is($found,0,"We should not have any finding with INFO level"); $tests++;
|
||||
|
||||
#2
|
||||
pass(" .. running testssl.sh against badssl.com to create a JSON-PRETTY report with severity level equal greater than LOW (may take 2~3 minutes)"); $tests++;
|
||||
$out = `./testssl.sh -S -e -U --jsonfile-pretty tmp.json --severity LOW --color 0 badssl.com`;
|
||||
$out = `./testssl.sh -S -e -U --ids-friendly --jsonfile-pretty tmp.json --severity LOW --color 0 badssl.com`;
|
||||
$json_pretty = json('tmp.json');
|
||||
unlink 'tmp.json';
|
||||
$found = 0;
|
||||
@ -14,7 +14,7 @@ my (
|
||||
);
|
||||
# OK
|
||||
pass("Running testssl.sh against badssl.com to create a baseline (may take 2~3 minutes)"); $tests++;
|
||||
my $okout = `./testssl.sh -S -e --freak --logjam --drown --rc4 --sweet32 --breach --crime --jsonfile tmp.json --color 0 badssl.com`;
|
||||
my $okout = `./testssl.sh -S -e --freak --logjam --drown --rc4 --sweet32 --breach --winshock --crime --jsonfile tmp.json --color 0 badssl.com`;
|
||||
my $okjson = json('tmp.json');
|
||||
unlink 'tmp.json';
|
||||
cmp_ok(@$okjson,'>',10,"We have more then 10 findings"); $tests++;
|
||||
|
||||
64
t/61_diff_testsslsh.t
Executable file
64
t/61_diff_testsslsh.t
Executable file
@ -0,0 +1,64 @@
|
||||
#!/usr/bin/env perl
|
||||
|
||||
# Baseline diff test against testssl.sh (csv output)
|
||||
#
|
||||
# We don't use a full run yet and only the certificate section.
|
||||
# There we would need to blacklist at least:
|
||||
# cert_serialNumber, cert_fingerprintSHA1, cert_fingerprintSHA256, cert
|
||||
# cert_expirationStatus, cert_notBefore, cert_notAfter, cert_caIssuers, intermediate_cert
|
||||
#
|
||||
# help is apreciated here
|
||||
|
||||
use strict;
|
||||
use Test::More;
|
||||
use Data::Dumper;
|
||||
use Text::Diff;
|
||||
|
||||
my $tests = 0;
|
||||
my $prg="./testssl.sh";
|
||||
my $master_socket_csv="./t/baseline_data/default_testssl.csvfile";
|
||||
my $socket_csv="tmp.csv";
|
||||
my $check2run="-p -s -P --fs -h -U -c -q --ip=one --color 0 --csvfile $socket_csv";
|
||||
#my $check2run="-p --color 0 --csvfile $socket_csv";
|
||||
my $uri="testssl.sh";
|
||||
my $diff="";
|
||||
|
||||
die "Unable to open $prg" unless -f $prg;
|
||||
die "Unable to open $master_socket_csv" unless -f $master_socket_csv;
|
||||
|
||||
|
||||
# Provide proper start conditions
|
||||
unlink "tmp.csv";
|
||||
|
||||
# Title
|
||||
printf "\n%s\n", "Diff unit test IPv4 against \"$uri\"";
|
||||
|
||||
#1 run
|
||||
`$prg $check2run $uri 2>&1`;
|
||||
|
||||
|
||||
$diff = diff $socket_csv, $master_socket_csv;
|
||||
|
||||
$socket_csv=`cat tmp.csv`;
|
||||
$master_socket_csv=`cat $master_socket_csv`;
|
||||
|
||||
# Filter, for now only HTTP_clock_skew
|
||||
$socket_csv=~ s/HTTP_clock_skew.*\n//g;
|
||||
$master_socket_csv=~ s/HTTP_clock_skew.*\n//g;
|
||||
|
||||
# Compare the differences to the master file -- and print differences if there were detected.
|
||||
# Filtering takes place later, so if there will be a difference detected it'll also show HTTP_clock_skew :-(
|
||||
#
|
||||
cmp_ok($socket_csv, "eq", $master_socket_csv, "Check whether CSV output matches master file from $uri") or
|
||||
diag ("\n%s\n", "$diff");
|
||||
|
||||
$tests++;
|
||||
|
||||
unlink "tmp.csv";
|
||||
|
||||
done_testing($tests);
|
||||
printf "\n";
|
||||
|
||||
|
||||
# vim:tw=95:ts=5:sw=5:et
|
||||
|
||||
@ -1,10 +1,10 @@
|
||||
### Naming scheme
|
||||
|
||||
* 00-05: Does the bare testssl.sh work at all?
|
||||
* 06-09: Does the reporting work at all?
|
||||
* 20-39: Do scans work fine (client side)?
|
||||
* 10-29: Do scans work fine (client side)?
|
||||
* 30-39: Does reporting work?
|
||||
* 50-69: Are the results what I expect (server side)?
|
||||
|
||||
Please help to write Travis/CI tests! Documentation can be found [here](https://perldoc.perl.org/Test/More.html).
|
||||
You can consult the existing code here. Feel free to use `20_baseline_ipv4_http.t` or `23_client_simulation.t` as a
|
||||
You can consult the existing code here. Feel free to use `10_baseline_ipv4_http.t` or `23_client_simulation.t` as a
|
||||
template.
|
||||
|
||||
137
t/baseline_data/default_testssl.csvfile
Normal file
137
t/baseline_data/default_testssl.csvfile
Normal file
@ -0,0 +1,137 @@
|
||||
"id","fqdn/ip","port","severity","finding","cve","cwe"
|
||||
"service","testssl.sh/81.169.166.184","443","INFO","HTTP","",""
|
||||
"pre_128cipher","testssl.sh/81.169.166.184","443","INFO","No 128 cipher limit bug","",""
|
||||
"SSLv2","testssl.sh/81.169.166.184","443","OK","not offered","",""
|
||||
"SSLv3","testssl.sh/81.169.166.184","443","OK","not offered","",""
|
||||
"TLS1","testssl.sh/81.169.166.184","443","LOW","offered (deprecated)","",""
|
||||
"TLS1_1","testssl.sh/81.169.166.184","443","LOW","offered (deprecated)","",""
|
||||
"TLS1_2","testssl.sh/81.169.166.184","443","OK","offered","",""
|
||||
"TLS1_3","testssl.sh/81.169.166.184","443","OK","offered with final","",""
|
||||
"NPN","testssl.sh/81.169.166.184","443","INFO","offered with h2, http/1.1 (advertised)","",""
|
||||
"ALPN_HTTP2","testssl.sh/81.169.166.184","443","OK","h2","",""
|
||||
"ALPN","testssl.sh/81.169.166.184","443","INFO","http/1.1","",""
|
||||
"cipherlist_NULL","testssl.sh/81.169.166.184","443","OK","not offered","","CWE-327"
|
||||
"cipherlist_aNULL","testssl.sh/81.169.166.184","443","OK","not offered","","CWE-327"
|
||||
"cipherlist_EXPORT","testssl.sh/81.169.166.184","443","OK","not offered","","CWE-327"
|
||||
"cipherlist_LOW","testssl.sh/81.169.166.184","443","OK","not offered","","CWE-327"
|
||||
"cipherlist_3DES_IDEA","testssl.sh/81.169.166.184","443","INFO","not offered","","CWE-310"
|
||||
"cipherlist_AVERAGE","testssl.sh/81.169.166.184","443","LOW","offered","","CWE-310"
|
||||
"cipherlist_GOOD","testssl.sh/81.169.166.184","443","OK","offered","",""
|
||||
"cipherlist_STRONG","testssl.sh/81.169.166.184","443","OK","offered","",""
|
||||
"cipher_order","testssl.sh/81.169.166.184","443","OK","server","",""
|
||||
"protocol_negotiated","testssl.sh/81.169.166.184","443","OK","Default protocol TLS1.3","",""
|
||||
"cipher_negotiated","testssl.sh/81.169.166.184","443","OK","TLS_AES_256_GCM_SHA384, 253 bit ECDH (X25519)","",""
|
||||
"cipher-tls1_xc014","testssl.sh/81.169.166.184","443","LOW","TLSv1 xc014 ECDHE-RSA-AES256-SHA ECDH 256 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA","",""
|
||||
"cipher-tls1_xc013","testssl.sh/81.169.166.184","443","LOW","TLSv1 xc013 ECDHE-RSA-AES128-SHA ECDH 256 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA","",""
|
||||
"cipher-tls1_x88","testssl.sh/81.169.166.184","443","LOW","TLSv1 x88 DHE-RSA-CAMELLIA256-SHA DH 2048 Camellia 256 TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA","",""
|
||||
"cipher-tls1_x45","testssl.sh/81.169.166.184","443","LOW","TLSv1 x45 DHE-RSA-CAMELLIA128-SHA DH 2048 Camellia 128 TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA","",""
|
||||
"cipher-tls1_x39","testssl.sh/81.169.166.184","443","LOW","TLSv1 x39 DHE-RSA-AES256-SHA DH 2048 AES 256 TLS_DHE_RSA_WITH_AES_256_CBC_SHA","",""
|
||||
"cipher-tls1_x33","testssl.sh/81.169.166.184","443","LOW","TLSv1 x33 DHE-RSA-AES128-SHA DH 2048 AES 128 TLS_DHE_RSA_WITH_AES_128_CBC_SHA","",""
|
||||
"cipher-tls1_x35","testssl.sh/81.169.166.184","443","LOW","TLSv1 x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA","",""
|
||||
"cipherorder_TLSv1","testssl.sh/81.169.166.184","443","INFO","ECDHE-RSA-AES256-SHA ECDHE-RSA-AES128-SHA DHE-RSA-CAMELLIA256-SHA DHE-RSA-CAMELLIA128-SHA DHE-RSA-AES256-SHA DHE-RSA-AES128-SHA AES256-SHA","",""
|
||||
"cipher-tls1_1_xc014","testssl.sh/81.169.166.184","443","LOW","TLSv1.1 xc014 ECDHE-RSA-AES256-SHA ECDH 256 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA","",""
|
||||
"cipher-tls1_1_xc013","testssl.sh/81.169.166.184","443","LOW","TLSv1.1 xc013 ECDHE-RSA-AES128-SHA ECDH 256 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA","",""
|
||||
"cipher-tls1_1_x88","testssl.sh/81.169.166.184","443","LOW","TLSv1.1 x88 DHE-RSA-CAMELLIA256-SHA DH 2048 Camellia 256 TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA","",""
|
||||
"cipher-tls1_1_x45","testssl.sh/81.169.166.184","443","LOW","TLSv1.1 x45 DHE-RSA-CAMELLIA128-SHA DH 2048 Camellia 128 TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA","",""
|
||||
"cipher-tls1_1_x39","testssl.sh/81.169.166.184","443","LOW","TLSv1.1 x39 DHE-RSA-AES256-SHA DH 2048 AES 256 TLS_DHE_RSA_WITH_AES_256_CBC_SHA","",""
|
||||
"cipher-tls1_1_x33","testssl.sh/81.169.166.184","443","LOW","TLSv1.1 x33 DHE-RSA-AES128-SHA DH 2048 AES 128 TLS_DHE_RSA_WITH_AES_128_CBC_SHA","",""
|
||||
"cipher-tls1_1_x35","testssl.sh/81.169.166.184","443","LOW","TLSv1.1 x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA","",""
|
||||
"cipherorder_TLSv1_1","testssl.sh/81.169.166.184","443","INFO","ECDHE-RSA-AES256-SHA ECDHE-RSA-AES128-SHA DHE-RSA-CAMELLIA256-SHA DHE-RSA-CAMELLIA128-SHA DHE-RSA-AES256-SHA DHE-RSA-AES128-SHA AES256-SHA","",""
|
||||
"cipher-tls1_2_xc030","testssl.sh/81.169.166.184","443","OK","TLSv1.2 xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH 256 AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","",""
|
||||
"cipher-tls1_2_xc02f","testssl.sh/81.169.166.184","443","OK","TLSv1.2 xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH 256 AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","",""
|
||||
"cipher-tls1_2_x9f","testssl.sh/81.169.166.184","443","OK","TLSv1.2 x9f DHE-RSA-AES256-GCM-SHA384 DH 2048 AESGCM 256 TLS_DHE_RSA_WITH_AES_256_GCM_SHA384","",""
|
||||
"cipher-tls1_2_x9e","testssl.sh/81.169.166.184","443","OK","TLSv1.2 x9e DHE-RSA-AES128-GCM-SHA256 DH 2048 AESGCM 128 TLS_DHE_RSA_WITH_AES_128_GCM_SHA256","",""
|
||||
"cipher-tls1_2_xc028","testssl.sh/81.169.166.184","443","LOW","TLSv1.2 xc028 ECDHE-RSA-AES256-SHA384 ECDH 256 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384","",""
|
||||
"cipher-tls1_2_xc014","testssl.sh/81.169.166.184","443","LOW","TLSv1.2 xc014 ECDHE-RSA-AES256-SHA ECDH 256 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA","",""
|
||||
"cipher-tls1_2_xc013","testssl.sh/81.169.166.184","443","LOW","TLSv1.2 xc013 ECDHE-RSA-AES128-SHA ECDH 256 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA","",""
|
||||
"cipher-tls1_2_x88","testssl.sh/81.169.166.184","443","LOW","TLSv1.2 x88 DHE-RSA-CAMELLIA256-SHA DH 2048 Camellia 256 TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA","",""
|
||||
"cipher-tls1_2_x45","testssl.sh/81.169.166.184","443","LOW","TLSv1.2 x45 DHE-RSA-CAMELLIA128-SHA DH 2048 Camellia 128 TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA","",""
|
||||
"cipher-tls1_2_x6b","testssl.sh/81.169.166.184","443","LOW","TLSv1.2 x6b DHE-RSA-AES256-SHA256 DH 2048 AES 256 TLS_DHE_RSA_WITH_AES_256_CBC_SHA256","",""
|
||||
"cipher-tls1_2_x39","testssl.sh/81.169.166.184","443","LOW","TLSv1.2 x39 DHE-RSA-AES256-SHA DH 2048 AES 256 TLS_DHE_RSA_WITH_AES_256_CBC_SHA","",""
|
||||
"cipher-tls1_2_x67","testssl.sh/81.169.166.184","443","LOW","TLSv1.2 x67 DHE-RSA-AES128-SHA256 DH 2048 AES 128 TLS_DHE_RSA_WITH_AES_128_CBC_SHA256","",""
|
||||
"cipher-tls1_2_x33","testssl.sh/81.169.166.184","443","LOW","TLSv1.2 x33 DHE-RSA-AES128-SHA DH 2048 AES 128 TLS_DHE_RSA_WITH_AES_128_CBC_SHA","",""
|
||||
"cipher-tls1_2_x9d","testssl.sh/81.169.166.184","443","OK","TLSv1.2 x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384","",""
|
||||
"cipher-tls1_2_x9c","testssl.sh/81.169.166.184","443","OK","TLSv1.2 x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256","",""
|
||||
"cipher-tls1_2_x3d","testssl.sh/81.169.166.184","443","LOW","TLSv1.2 x3d AES256-SHA256 RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA256","",""
|
||||
"cipher-tls1_2_x35","testssl.sh/81.169.166.184","443","LOW","TLSv1.2 x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA","",""
|
||||
"cipherorder_TLSv1_2","testssl.sh/81.169.166.184","443","INFO","ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES128-GCM-SHA256 DHE-RSA-AES256-GCM-SHA384 DHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES256-SHA384 ECDHE-RSA-AES256-SHA ECDHE-RSA-AES128-SHA DHE-RSA-CAMELLIA256-SHA DHE-RSA-CAMELLIA128-SHA DHE-RSA-AES256-SHA256 DHE-RSA-AES256-SHA DHE-RSA-AES128-SHA256 DHE-RSA-AES128-SHA AES256-GCM-SHA384 AES128-GCM-SHA256 AES256-SHA256 AES256-SHA","",""
|
||||
"cipher-tls1_3_x1302","testssl.sh/81.169.166.184","443","OK","TLSv1.3 x1302 TLS_AES_256_GCM_SHA384 ECDH 253 AESGCM 256 TLS_AES_256_GCM_SHA384","",""
|
||||
"cipher-tls1_3_x1303","testssl.sh/81.169.166.184","443","OK","TLSv1.3 x1303 TLS_CHACHA20_POLY1305_SHA256 ECDH 253 ChaCha20 256 TLS_CHACHA20_POLY1305_SHA256","",""
|
||||
"cipher-tls1_3_x1301","testssl.sh/81.169.166.184","443","OK","TLSv1.3 x1301 TLS_AES_128_GCM_SHA256 ECDH 253 AESGCM 128 TLS_AES_128_GCM_SHA256","",""
|
||||
"cipherorder_TLSv1_3","testssl.sh/81.169.166.184","443","INFO","TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_GCM_SHA256","",""
|
||||
"FS","testssl.sh/81.169.166.184","443","OK","offered","",""
|
||||
"FS_ciphers","testssl.sh/81.169.166.184","443","INFO","TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA384 ECDHE-RSA-AES256-SHA DHE-RSA-AES256-GCM-SHA384 DHE-RSA-AES256-SHA256 DHE-RSA-AES256-SHA DHE-RSA-CAMELLIA256-SHA TLS_AES_128_GCM_SHA256 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA DHE-RSA-AES128-GCM-SHA256 DHE-RSA-AES128-SHA256 DHE-RSA-AES128-SHA DHE-RSA-CAMELLIA128-SHA","",""
|
||||
"FS_ECDHE_curves","testssl.sh/81.169.166.184","443","OK","prime256v1 secp384r1 secp521r1 X25519 X448","",""
|
||||
"DH_groups","testssl.sh/81.169.166.184","443","OK","Unknown DH group (2048 bits)","",""
|
||||
"HTTP_status_code","testssl.sh/81.169.166.184","443","INFO","200 OK ('/')","",""
|
||||
"HTTP_clock_skew","testssl.sh/81.169.166.184","443","INFO","0 seconds from localtime","",""
|
||||
"HSTS_time","testssl.sh/81.169.166.184","443","OK","362 days (=31337000 seconds) > 15465600 seconds","",""
|
||||
"HSTS_subdomains","testssl.sh/81.169.166.184","443","INFO","only for this domain","",""
|
||||
"HSTS_preload","testssl.sh/81.169.166.184","443","INFO","domain is NOT marked for preloading","",""
|
||||
"HPKP","testssl.sh/81.169.166.184","443","INFO","No support for HTTP Public Key Pinning","",""
|
||||
"banner_server","testssl.sh/81.169.166.184","443","INFO","Never trust a banner","",""
|
||||
"banner_application","testssl.sh/81.169.166.184","443","INFO","X-Powered-By: A portion of humor","",""
|
||||
"cookie_count","testssl.sh/81.169.166.184","443","INFO","0 at '/'","",""
|
||||
"X-Frame-Options","testssl.sh/81.169.166.184","443","OK","DENY","",""
|
||||
"X-Content-Type-Options","testssl.sh/81.169.166.184","443","OK","nosniff","",""
|
||||
"Content-Security-Policy","testssl.sh/81.169.166.184","443","OK","script-src 'unsafe-inline'; style-src 'unsafe-inline' 'self'; default-src 'self' ; child-src 'none'; object-src 'self'; frame-ancestors 'self'; upgrade-insecure-requests","",""
|
||||
"Expect-CT","testssl.sh/81.169.166.184","443","OK","max-age=86400, enforce","",""
|
||||
"X-XSS-Protection","testssl.sh/81.169.166.184","443","INFO","1; mode=block","",""
|
||||
"banner_reverseproxy","testssl.sh/81.169.166.184","443","INFO","--","","CWE-200"
|
||||
"heartbleed","testssl.sh/81.169.166.184","443","OK","not vulnerable, no heartbeat extension","CVE-2014-0160","CWE-119"
|
||||
"CCS","testssl.sh/81.169.166.184","443","OK","not vulnerable","CVE-2014-0224","CWE-310"
|
||||
"ticketbleed","testssl.sh/81.169.166.184","443","OK","no session ticket extension","CVE-2016-9244","CWE-200"
|
||||
"ROBOT","testssl.sh/81.169.166.184","443","OK","not vulnerable","CVE-2017-17382 CVE-2017-17427 CVE-2017-17428 CVE-2017-13098 CVE-2017-1000385 CVE-2017-13099 CVE-2016-6883 CVE-2012-5081 CVE-2017-6168","CWE-203"
|
||||
"secure_renego","testssl.sh/81.169.166.184","443","OK","supported","","CWE-310"
|
||||
"secure_client_renego","testssl.sh/81.169.166.184","443","OK","not vulnerable","CVE-2011-1473","CWE-310"
|
||||
"CRIME_TLS","testssl.sh/81.169.166.184","443","OK","not vulnerable","CVE-2012-4929","CWE-310"
|
||||
"BREACH","testssl.sh/81.169.166.184","443","OK","not vulnerable, no gzip/deflate/compress/br HTTP compression - only supplied '/' tested","CVE-2013-3587","CWE-310"
|
||||
"POODLE_SSL","testssl.sh/81.169.166.184","443","OK","not vulnerable, no SSLv3","CVE-2014-3566","CWE-310"
|
||||
"fallback_SCSV","testssl.sh/81.169.166.184","443","OK","supported","",""
|
||||
"SWEET32","testssl.sh/81.169.166.184","443","OK","not vulnerable","CVE-2016-2183 CVE-2016-6329","CWE-327"
|
||||
"FREAK","testssl.sh/81.169.166.184","443","OK","not vulnerable","CVE-2015-0204","CWE-310"
|
||||
"DROWN","testssl.sh/81.169.166.184","443","OK","not vulnerable on this host and port","CVE-2016-0800 CVE-2016-0703","CWE-310"
|
||||
"DROWN_hint","testssl.sh/81.169.166.184","443","INFO","Make sure you don't use this certificate elsewhere with SSLv2 enabled services, see https://censys.io/ipv4?q=B95B85E87BA020CD25A95DF53CDD16C7DCEA96EFE7FEF9411529D511B39015B3","CVE-2016-0800 CVE-2016-0703","CWE-310"
|
||||
"LOGJAM","testssl.sh/81.169.166.184","443","OK","not vulnerable, no DH EXPORT ciphers,","CVE-2015-4000","CWE-310"
|
||||
"LOGJAM-common_primes","testssl.sh/81.169.166.184","443","OK","--","CVE-2015-4000","CWE-310"
|
||||
"BEAST_CBC_TLS1","testssl.sh/81.169.166.184","443","MEDIUM","ECDHE-RSA-AES256-SHA ECDHE-RSA-AES128-SHA DHE-RSA-CAMELLIA256-SHA DHE-RSA-CAMELLIA128-SHA DHE-RSA-AES256-SHA DHE-RSA-AES128-SHA AES256-SHA","CVE-2011-3389","CWE-20"
|
||||
"BEAST","testssl.sh/81.169.166.184","443","LOW","VULNERABLE -- but also supports higher protocols TLSv1.1 TLSv1.2 (likely mitigated)","CVE-2011-3389","CWE-20"
|
||||
"LUCKY13","testssl.sh/81.169.166.184","443","LOW","potentially vulnerable, uses TLS CBC ciphers","CVE-2013-0169","CWE-310"
|
||||
"winshock","testssl.sh/81.169.166.184","443","OK","not vulnerable","CVE-2014-6321","CWE-94"
|
||||
"RC4","testssl.sh/81.169.166.184","443","OK","not vulnerable","CVE-2013-2566 CVE-2015-2808","CWE-310"
|
||||
"clientsimulation-android_442","testssl.sh/81.169.166.184","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-android_500","testssl.sh/81.169.166.184","443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||
"clientsimulation-android_60","testssl.sh/81.169.166.184","443","INFO","TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256","",""
|
||||
"clientsimulation-android_70","testssl.sh/81.169.166.184","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-android_81","testssl.sh/81.169.166.184","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-android_90","testssl.sh/81.169.166.184","443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-android_X","testssl.sh/81.169.166.184","443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-chrome_74_win10","testssl.sh/81.169.166.184","443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-chrome_79_win10","testssl.sh/81.169.166.184","443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-firefox_66_win81","testssl.sh/81.169.166.184","443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-firefox_71_win10","testssl.sh/81.169.166.184","443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-ie_6_xp","testssl.sh/81.169.166.184","443","INFO","No connection","",""
|
||||
"clientsimulation-ie_8_win7","testssl.sh/81.169.166.184","443","INFO","TLSv1.0 ECDHE-RSA-AES256-SHA","",""
|
||||
"clientsimulation-ie_8_xp","testssl.sh/81.169.166.184","443","INFO","No connection","",""
|
||||
"clientsimulation-ie_11_win7","testssl.sh/81.169.166.184","443","INFO","TLSv1.2 DHE-RSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-ie_11_win81","testssl.sh/81.169.166.184","443","INFO","TLSv1.2 DHE-RSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-ie_11_winphone81","testssl.sh/81.169.166.184","443","INFO","TLSv1.2 ECDHE-RSA-AES256-SHA","",""
|
||||
"clientsimulation-ie_11_win10","testssl.sh/81.169.166.184","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-edge_15_win10","testssl.sh/81.169.166.184","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-edge_17_win10","testssl.sh/81.169.166.184","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-opera_66_win10","testssl.sh/81.169.166.184","443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-safari_9_ios9","testssl.sh/81.169.166.184","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-safari_9_osx1011","testssl.sh/81.169.166.184","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-safari_10_osx1012","testssl.sh/81.169.166.184","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-safari_121_ios_122","testssl.sh/81.169.166.184","443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-safari_130_osx_10146","testssl.sh/81.169.166.184","443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-apple_ats_9_ios9","testssl.sh/81.169.166.184","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-java_6u45","testssl.sh/81.169.166.184","443","INFO","No connection","",""
|
||||
"clientsimulation-java_7u25","testssl.sh/81.169.166.184","443","INFO","TLSv1.0 ECDHE-RSA-AES128-SHA","",""
|
||||
"clientsimulation-java_8u161","testssl.sh/81.169.166.184","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-java1102","testssl.sh/81.169.166.184","443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-java1201","testssl.sh/81.169.166.184","443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-openssl_102e","testssl.sh/81.169.166.184","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-openssl_110l","testssl.sh/81.169.166.184","443","INFO","TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384","",""
|
||||
"clientsimulation-openssl_111d","testssl.sh/81.169.166.184","443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
"clientsimulation-thunderbird_68_3_1","testssl.sh/81.169.166.184","443","INFO","TLSv1.3 TLS_AES_256_GCM_SHA384","",""
|
||||
Reference in New Issue
Block a user