diff --git a/Readme.md b/Readme.md index a1a1137..e649e82 100644 --- a/Readme.md +++ b/Readme.md @@ -11,26 +11,25 @@ cryptographic flaws. #### Key features * Clear output: you can tell easily whether anything is good or bad -* Ease of installation: It works for Linux, OSX/Darwin, FreeBSD, NetBSD, - OpenBSD (needs bash) and MSYS2/Cygwin out of the box: no need to install - or to configure something. No gems, CPAN, pip or the like/ +* Machine readable output +* Ease of installation: Linux, OSX/Darwin, FreeBSD, NetBSD, MSYS2/Cygwin, + WSL work out of the box (OpenBSD needs bash). No need to install + or to configure something. No gems, CPAN, pip or the like * Flexibility: You can test any SSL/TLS enabled and STARTTLS service, not - only webservers at port 443 + only web servers at port 443 * Toolbox: Several command line options help you to run YOUR test and configure YOUR output * Reliability: features are tested thoroughly -* Verbosity: If a particular check cannot be performed because of a missing - capability on your client side, you'll get a warning * Privacy: It's only you who sees the result, not a third party * Freedom: It's 100% open source. You can look at the code, see what's - going on and you can change it. -* Heck, even the development is open (github) + going on +* The development is open (github) and participation is welcome. #### License This software is free. You can use it under the terms of GPLv2, see LICENSE. -In addition starting from version 3.0rc1 if you're offering it as a public -and / or paid service you need to mention to your audience that you're using +In addition starting from version 3.0rc1 if you're offering a scanner based on testssl.sh +as a public and / or paid service in the internet you need to mention to your audience that you're using this program and where to get this program from. #### Installation @@ -44,25 +43,27 @@ https://github.com/drwetter/testssl.sh/archive/2.9dev.zip. ``testssl.sh --help` will give you some help upfront. More help: see doc directory with man pages. Older sample runs are at https://testssl.sh/. +#### Running a docker container from dockerhub + + docker run -ti drwetter/testssl.sh #### Status -Here in the _2.9dev branch you find the development version_ of the software --- with new features and maybe some bugs -- albeit we try our best before -committing to test changes. Be aware that we also change the output or command -line. +In the 2.9dev branch we're developing the 3.0 release. We're currently in the +release candidate phase. That means you can and should use it for production +and let us know if you encounter any additional bugs. -For the previous stable version please see [testssl.sh](https://testssl.sh/ -"Go to the site with the stable version") or -download the interim release 2.9.5 from here [2.9.5](https://github.com/drwetter/testssl.sh/tree/2.9.5) which is is the -successor of 2.8 and stable for day-to-day work. +For the previous stable version please see release +[2.9.5](https://github.com/drwetter/testssl.sh/tree/2.9.5) which is is the +successor of 2.8 and stable for day-to-day work. Support for 2.9.5 will be +soon dropped. 2.8 is not supported anymore. #### Compatibility testssl.sh is working on every Linux/BSD distribution out of the box. Since 2.9dev most of the limitations of disabled features from the openssl client are gone -due to bash-socket-based checks. As a result you can also use e.g. LibreSSL. -testssl.sh also works on other unixoid system out of the box, supposed they have +due to bash-socket-based checks. As a result you can also use e.g. LibreSSL or OpenSSL +1.1.1. testssl.sh also works on other unixoid system out of the box, supposed they have `/bin/bash` >= version 3.2 and standard tools like sed and awk installed. System V needs to have GNU grep installed. MacOS X and Windows (using MSYS2 or cygwin) work too. OpenSSL version version >= 1.0.2 is recommended for better @@ -70,68 +71,59 @@ LOGJAM checks and to display bit strengths for key exchanges. Update notification here or @ [twitter](https://twitter.com/drwetter). -#### Features implemented in [2.9dev](Readme.md#devel) -* Using bash sockets where ever possible --> better detection of ciphers, independent on the openssl version used. -* Testing 364 default ciphers (``testssl.sh -e/-E``) with a mixture of sockets and openssl. Same speed as with openssl only but additional ciphers such as post-quantum ciphers, new CHAHA20/POLY1305, CamelliaGCM etc. -* Further tests via TLS sockets and improvements (handshake parsing, completeness, robustness), -* TLS 1.2 protocol check via socket in production -* Finding more TLS extensions via sockets -* TLS Supported Groups Registry (RFC 7919), key shares extension -* Non-flat JSON support -* File output (CSV, JSON flat, JSON non-flat) supports a minimum severity level (only above supplied level there will be output) -* Support of supplying timeout value for ``openssl connect`` -- useful for batch/mass scanning -* Parallel mass testing (!) -* File input for serial or parallel mass testing can be also in nmap grep(p)able (-oG) format -* Native HTML support instead going through 'aha' -* Better formatting of output (indentation) -* Choice showing the RFC naming scheme only -* LUCKY13 and SWEET32 checks -* Check for vulnerability to Bleichenbacher attacks -* Ticketbleed check +#### Features implemented in [2.9dev](Readme.md#devel) (as opposed to [2.9.5](https://github.com/drwetter/testssl.sh/blob/2.9.5/Readme.md#features-implemented-in-295)) +* Full support of TLS 1.3, shows also drafts supported +* ROBOT check +* Better TLS extension support +* Better OpenSSL 1.1.1 support +* DNS over Proxy and other proxy improvements * Decoding of unencrypted BIG IP cookies -* LOGJAM: now checking also for known DH parameters -* Check for CAA RR -* Check for OCSP must staple -* Check for Certificate Transparency -* Expect-CT Header Detection +* Better JSON output: renamed IDs and findings shorter/better parsable +* JSON output now valid also for non-responding servers +* Testing now per default 370 ciphers +* Further improving the robustness of TLS sockets (sending and parsing) +* Support of supplying timeout value for ``openssl connect`` -- useful for batch/mass scanning +* File input for serial or parallel mass testing can be also in nmap grep(p)able (-oG) format +* LOGJAM: now checking also for DH and FFDHE groups (TLS 1.2) +* PFS: Display of elliptical curves supported, DH and FFDHE groups (TLS 1.2 + TLS 1.3) * Check for session resumption (Ticket, ID) * TLS Robustness check (GREASE) -* Postgres und MySQL STARTTLS support, MongoDB support -* Decodes BIG IP F5 Cookie +* Expect-CT Header Detection +* --phone-out does certificate revocation checks via OCSP (LDAP+HTTP) and with CRL * Fully OpenBSD and LibreSSL support * Missing SAN warning -* Man page -* Better error msg suppression (not fully installed OpenSSL) -* DNS over Proxy and other proxy improvements -* Better JSON output: renamed IDs and findings shorter/better parsable -* JSON output now valid also for non-responsing servers * Added support for private CAs -* Exit code now 0 for running without error -* ROBOT check -* Better extension support -* Better OpenSSL 1.1.1 support -* Supports latest and greatest version of TLS 1.3, shows drafts supported +* Man page reviewed +* Better error msg suppression (not fully installed OpenSSL) +* Way better handling of connectivity problems +* Exit codes better: 0 for running without error, 1+n for small errors, >240 for major errors. +* Dockerfile and repo @ docker hub with that file (see above) +* Java Root CA store added +* Better support for XMPP via STARTTLS & faster +* Certificate check for to-name in stream of XMPP +* Support for NNTP via STARTTLS +* More robustness for any STARTTLS protocol (fall back to plaintext while in TLS) +* Fixed TCP fragmentation +* Added `--ids-friendly` switch -#### Further features planned in 2.9dev +[Planned for 3.0](https://github.com/drwetter/testssl.sh/milestone/4). + + +#### Documentation + +* There's a man page in groff, html and markdown format in `~/doc/`. +* https://testssl.sh/ will help to get you started. +* Will Hunt provides a longer, good [description](https://www.4armed.com/blog/doing-your-own-ssl-tls-testing/) for the version 2.8, including useful background info. -https://github.com/drwetter/testssl.sh/issues?q=is%3Aopen+is%3Aissue+milestone%3A2.9dev #### Contributions Contributions, feedback, bug reports are welcome! For contributions please note: One patch per feature -- bug fix/improvement. Please test your -changes thouroughly as reliability is important for this project. +changes thoroughly as reliability is important for this project. There's a [coding guideline](https://github.com/drwetter/testssl.sh/wiki/Coding-Style). -Please file bug reports @ https://github.com/drwetter/testssl.sh/issues. - -#### Documentation - -For a start see the -[wiki](https://github.com/drwetter/testssl.sh/wiki/Man-Page). -Help is needed here. Will Hunt provides a good [description](https://www.4armed.com/blog/doing-your-own-ssl-tls-testing/) for version 2.8, including useful background info. - #### Bug reports Please file bugs in the issue tracker. Do not forget to provide detailed information, @@ -151,7 +143,7 @@ respective projects #### Mass scanner w parallel scans and elastic searching the results * https://github.com/TKCERT/testssl.sh-masscan -#### A ready-to-go docker image is at: +#### Another ready-to-go docker image is at: * https://quay.io/repository/jumanjiman/testssl #### Privacy checker using testssl.sh