Git/testssl.sh
1
0
Fork 0
mirror of https://github.com/drwetter/testssl.sh.git synced 2026-09-14 13:48:16 +02:00
Code Issues Packages Projects Releases Wiki Activity
3,425 Commits 16 Branches 39 Tags
2f398d3cd0b7717507406846abe136b04992bab3
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Dirk WetterandGitHub 2f398d3cd0 Merge pull request #1951 from drwetter/fix_1717_3.0 
Look-ahead trick for -U --ids-friendly (3.0)
 2021-08-01 17:46:58 +02:00
Dirk e293b7d839 Look-ahead trick for -U --ids-friendly 
If the order of the cmdline is '-U --ids-friendly' then we need to make sure we catch --ids-friendly. Normally we do not,
 see #1717. The following statement makes sure. In the do-while + case-esac loop  the check for --ids-friendly will be
executed again, but it does not hurt
 2021-07-31 18:47:00 +02:00
Dirk WetterandGitHub 0d6ca5c1b8 Merge pull request #1947 from drwetter/noitalics4screen_3.0 
Disable ANSI codes for italic when TERM == screen
 2021-07-31 15:26:26 +02:00
Dirk 13303753ff Disable ANSI codes for italic when TERM == screen 
... otherwise it is being printed in reverse, see #1928.
Same as #1946 but for the 3.0 branch.
 2021-07-31 13:22:47 +02:00
Dirk WetterandGitHub 5d4945819a Merge pull request #1944 from drwetter/docker_3.0 
Docker updates
 2021-07-30 17:36:20 +02:00
Dirk Wetter 4e8dd46815 Update description 
* tar.gz is now from testssl.sh
    * git clone refers to 3.0 instead of 3.1dev
 2021-07-30 17:34:56 +02:00
Dirk Wetter 6ffbf1bfa4 Update description 
* tar.gz is now from testssl.sh
* git clone refers to 3.0 instead of 3.1dev
 2021-07-30 17:33:08 +02:00
Dirk Wetter 5df1a2e7b9 Upgrade to alpine 3.12 
... as 3.11 is in a couple of months EOL .

I do not expect difficulties as we run 3.12 already in 3.1dev.
 2021-07-30 17:23:51 +02:00
Dirk WetterandGitHub e7713f8012 Merge pull request #1942 from drwetter/nmap_portdetection_1931_3.0 
Improved SSL/TLS portdetection in nmap greppable files (3.0)
 2021-07-30 15:51:23 +02:00
Dirk Wetter 5ae17681f6 Improved SSL/TLS portdetection in nmap greppable files (3.0) 
As mentioned in #1931 the port detection for nmap greppable files
leaves space for improvements.

Ths PR adds a pattern detection of ssl and https in the forth or fifth
parameter of an open port, so those ports will be added to a scan when
a nmap greppable output file is supplied as input to testssl.sh .

Also it does minor code adjustments to utils/gmap2testssl.sh .

Same as #1938, only for 3.0.
 2021-07-30 14:47:17 +02:00
Dirk WetterandGitHub f4800f8e5e Merge pull request #1937 from drwetter/fix_1935_3.0 
Fix problem when nmap file has .txt extension (3.0)
 2021-07-25 17:17:39 +02:00
Dirk 29bd7591f9 Supply new converter which matches on ssl and https 
... see #1936.

It is ~ copied from testssl.sh. It adds a detection for the
strings ssl and https. If those run at non-standard ports but nmap
detected it, it'll show up in the output file.
 2021-07-25 16:56:02 +02:00
Dirk 3544014fe3 Fix problem when nmap file has .txt extension (3.0) 
This addresses a bug filed in #1935 in 3.1dev when the supplied file
has a .txt extension. In this scenario the input file was nulled
as from the input file in nmap format an internal input file was
generated which has a .txt extension, in the same directory.
The idea was to persist the file for the user.

Now, this internal input file is ephemeral and only written to $TEMPDIR.
 2021-07-25 16:40:16 +02:00
Dirk WetterandGitHub ca558a9c08 Merge pull request #1922 from drwetter/gha_denylist_3.0 
Github actions modifications (3.0)
 2021-06-19 15:21:04 +02:00
Dirk 6fd4c466e4 Github actions modifications (3.0) 
Same as #1921, only for the stable branch

* define deny list of files when modified not to run GHA
* specitfy OS to be ubuntu-20.04 (is there a debian at all?)
* only use perl 5.26

See #1920
 2021-06-19 12:32:06 +02:00
Dirk WetterandGitHub 526bccaa34 Merge pull request #1918 from drwetter/travis2gha_3.0 
Migrate from travis-ci.org to github actions
 2021-06-18 09:56:57 +02:00
Dirk Wetter 7b9a6e334d Migrate from travis-ci.,org to github actions 
Kudos to Mikel, see PR #1909
 2021-06-18 08:39:00 +02:00
Dirk WetterandGitHub f7b29cac99 Merge pull request #1916 from drwetter/fix_1915_3.0 
Fix indentation and redundant message (BREACH) when client certificate required
 2021-06-17 09:29:19 +02:00
Dirk Wetter 19feed169e Fix indentation and redundant message (BREACH) when client certificate required 
... see #1915
 2021-06-17 09:23:34 +02:00
Dirk WetterandGitHub 96e8f67999 Merge pull request #1906 from drwetter/tz_fix+3.0 
Display time as suggested in utc (3.0)
 2021-06-03 20:23:20 +02:00
Dirk Wetter f6a9044315 Display time as suggested in utc (3.0) 
This fixes #1895
 2021-06-03 19:29:26 +02:00
Dirk WetterandGitHub c0d9427988 Merge pull request #1889 from dcooper16/send_to_stderr_30 
Print errors to stderr
 2021-05-15 12:22:43 +02:00
Dirk WetterandGitHub 931d0095d6 Merge pull request #1887 from ghen2/3.0-uname 
`hostname` is not defined by POSIX, use portable `uname -n` instead.
 2021-05-13 16:11:11 +02:00
Dirk WetterandGitHub 6829996197 Merge pull request #1886 from drwetter/3.0.5 
Bump version
 2021-05-10 13:50:07 +02:00
Dirk Wetter f5fde2a93b Bump version 2021-05-10 12:16:12 +02:00
Dirk WetterandGitHub 4976da43b0 Merge pull request #1883 from drwetter/epoch_180hsts_1879.branch_3.0 
Fix "off by one" error in HSTS
 2021-05-10 11:18:53 +02:00
Dirk WetterandGitHub 5758c397da Merge pull request #1885 from definity/3.0 
fixed minor bug with json output for TLS1.1
 2021-05-09 20:37:07 +02:00
Dirk Wetter 68cbdf8dc8 Fix "off by one" error in HSTS 
There was by mistake a 179 days threshold and also the error message
was wrong when HSTS was exactly set to 179 days, see #1879.

This commit sets it to 180 days and corrects the error messages on
screen.
 2021-05-08 14:55:30 +02:00
Dirk WetterandGitHub 835abd6acb Merge pull request #1870 from dcooper16/fix_ossl30 
Improve compatibility with OpenSSL 3.0
 2021-04-09 10:44:12 +02:00
Dirk WetterandGitHub 52ed92ca87 Merge pull request #1866 from drwetter/fix1860_svSE_etc_charset_3.0 
Ensure certain regex patterns work as expected and aren't localized (3.0)
 2021-04-05 14:29:22 +02:00
Dirk c461702112 Ensure certain regex patterns work as expected and aren't localized (3.0) 
Same as #1865.

This PR is trying to address an issue where probably newer bash versions treat
regexes differently in other locales. W is with a swedish locale just a variant
of V (#1860) see also e.g.

https://collation-charts.org/opensolaris/opensolaris.2008.05.sv_SE.UTF-8.html
https://www.sqlservercentral.com/forums/topic/order-by-name-not-works#post-1644177
 2021-04-05 11:38:17 +02:00
Dirk WetterandGitHub 7723a309b5 Merge pull request #1858 from jschauma/3.0 
add codepoints for RFC7905, ChaCha20-Poly1305
 2021-03-25 21:34:04 +01:00
Dirk WetterandGitHub acc9a82a07 Merge pull request #1848 from elfranne/ianaopenssl3.0 
IANA <-> Openssl mapping issue for 3.0
 2021-02-25 17:17:39 +01:00
Dirk WetterandGitHub bf966a9b2f Merge pull request #1831 from drwetter/fix_heartbleed_json.1828_3.0 
Fix file output formatting for heartbleed (3.0)
 2021-01-20 10:11:51 +01:00
Dirk a1777cdd0e Fix file output formatting for heartbleed 
Quotes were wrong for different results, which lead to some confusion
for finding, cve and cwe.

Fixes #1828
 2021-01-20 09:04:11 +01:00
Dirk WetterandGitHub 2627d9db13 Merge pull request #1825 from drwetter/fix_travis_3.0 
Travis CI didn't run. Trying to fix it (3.0)
 2021-01-18 09:15:14 +01:00
Dirk 4ee936dc52 Travis CI didn't run. Trying to fix it 2021-01-13 22:35:34 +01:00
Dirk WetterandGitHub 4b800b0ae5 Merge pull request #1822 from drwetter/fix_dot@NODE 
Fixes trailing dot error in URL handling (3.0)
 2021-01-13 21:56:48 +01:00
Dirk Wetter b8e76a3861 Fixes trailing dot error in URL handling 
For DNS queries a trailing dot in the variable $NODE is always fine. For
HTTP queries it is not. and causes the https request to fail.

Backport from 4f1da9b192

Also: removal of ancient CVS_REL relict in $TEMPDIR/environment.txt
 2021-01-13 11:35:31 +01:00
Dirk WetterandGitHub 666a2c4edb Merge pull request #1818 from drwetter/le_issuer_fix1816_3.0 
Fix issuer check for Let's Encrypt (3.0)
 2021-01-07 10:32:12 +01:00
Dirk Wetter 0de00f4322 Fix issuer check for Let's Encrypt (3.0) 
Fixes #1816 for 3.0 by a proper halving of the dates
 2021-01-07 10:29:08 +01:00
Dirk WetterandGitHub cb94ffaa13 Merge pull request #1796 from drwetter/no_code_update3.0 
Trying to save resources for Travis/CI (3.0)
 2020-11-28 10:15:13 +01:00
Dirk 98d1bd64bc Trying to save resources for Travis/CI (3.0) 
See https://github.com/google/EarlGrey/pull/383/files/3b38a5dea36a88aba42a42931e77a7c5429a1837
 2020-11-28 10:12:43 +01:00
Dirk WetterandGitHub dc08a120ba Merge pull request #1793 from drwetter/docker_docu_polish3.0 
Consolidate docker sections in Readme.md and Dockerfile.md (3.0)
 2020-11-27 16:54:26 +01:00
Dirk Wetter 7c835470be Consolidate docker sections in Readme.md and Dockerfile.md 
see #1791
 2020-11-27 16:53:28 +01:00
Dirk WetterandGitHub 7dac1a20f7 Merge pull request #1780 from drwetter/fix_1779 
Fix 1779
 2020-11-20 16:27:10 +01:00
Dirk ca89328ed4 Change version number 
To avoid clashes with distributors it may be is smarter to stick
to three numbers and not intoducing another digit.

3.0.4 <-- 3.0.3.1
 2020-11-20 11:09:17 +01:00
Dirk e441357efe Fix reading SSLv2 socket (3.0 branch) 
This fixes #1779. There was a problem introduced in
3c97412a61 which counted
the size of the file name rather than the size of the
socket reply.
 2020-11-20 11:06:22 +01:00
Dirk b08b5d8b98 Bump version to 3.0.3 2020-11-19 09:41:12 +01:00
Dirk WetterandGitHub 0abaa6d2bf Merge pull request #1774 from drwetter/ca-update_3.0 
Update certificate stores (3.0 branch)
 2020-11-14 11:11:03 +01:00
Dirk Wetter 2f18dcbd58 Update remaining stores: Apple / Java / Microsoft 
* also ca_hashes.txt

* Used Java SDK 15 instead of JRE 8
* Used Windows 10 20H2
* Java Keystore has added 5 certificates (90 --> 95)

Updated Readme and make instructions more reproducible

Fixes #1772
 2020-11-13 22:13:10 +01:00
Dirk WetterandGitHub d536c07b72 Merge pull request #1776 from drwetter/fix_1762_3.0 
Stop labeling X-XSS-Protection as green (3.0 branch)
 2020-11-13 15:24:22 +01:00
Dirk Wetter 99a158d952 Stop labeling X-XSS-Protection as green (3.0 branch) 
* X-XSS-Protection is now labled as a neutral finding as suggested in #1762
* Also it adds colons to header values

This a quick fix for the stable version as opposed to #1764 ff.
It also changes the color from lite cyan to neutral
 2020-11-13 13:57:21 +01:00
Dirk Wetter a180ec4f80 update Linux.pem + Mozilla.pem 2020-11-11 18:37:56 +01:00
Dirk WetterandGitHub f3abf77ed8 Merge pull request #1761 from keisentraut/fix-1757-3.0 
fix #1757: manpage: --c has one dash to much (backport 3.0)
 2020-10-29 20:28:23 +01:00
Dirk WetterandGitHub 0cf5a49762 Merge pull request #1759 from drwetter/fix_1754_3.0 
Fix run_freak() when sslv2 server hello is empty (3.0 branch)
 2020-10-28 15:05:51 +01:00
Dirk Wetter 3c97412a61 Address complaint by Travis + RC4 SSLv2 ciphers shortcut 
Despite the fact google doesn't support RC4 ciphers, testssl.sh called
sslv2_sockets(). Google answered with a >= TLS alert. Building a sum then
failed then in sslv2_sockets().

This fixes sslv2_sockets() and introduces count_chars() as a helper function
(tested also under old FreeBSD to make sure it works under MacOSX).

Also it adds a shortcut: if we are sure we don't have sslv2 we don't need
to test any RC4 SSLv2 ciphers
 2020-10-28 11:45:41 +01:00
Dirk 4ddc90d98d Fix run_freak() when sslv2 server hello is empty (3.0 branch) 
This fixes #1754 by avoiding further string operations if the SSLv2 socket reply is empty as bash 5.1 seems to have a problem with that. The fix is done in sslv2_sockets() .

Also sslv2 is not being used in run_freak() if known not to be supported.
 2020-10-27 22:48:50 +01:00
Dirk WetterandGitHub cd9b98ca70 Merge pull request #1727 from drwetter/fix_1725_SCIR_3.0 
Fix Secure Client-Initiated Renegotiation false positive (3.0 branch)
 2020-09-16 20:13:33 +02:00
Dirk 08feaf4a0c Fix Secure Client-Initiated Renegotiation false positive (3.0 branch) 
Server side closed the connection but openssl retrieved
a zero exit code. In addition now we look for "closed"
and if that was returned from the server we label it
as not vulnerable.

This fixes #1725.

Same fix as for 3.1dev, see #1726
 2020-09-16 18:13:47 +02:00
Dirk WetterandGitHub c0581afeeb Merge pull request #1712 from dcooper16/fix1699_3.0 
Fix #1699 in 3.0 branch
 2020-08-31 17:07:46 +02:00
Dirk d9866d875a Revised risk for BREACH --> medium 2020-07-10 19:56:18 +02:00
Dirk WetterandGitHub e1b0f2d55f Merge pull request #1673 from dcooper16/fix_unrecognized_option_3.0 
Fix printing of unrecognized option in 3.0 branch
 2020-07-07 15:54:11 +02:00
Dirk WetterandGitHub 2949b95937 Merge pull request #1667 from dcooper16/fix1665_3.0 
Fix #1665 in 3.0 branch
 2020-06-25 20:45:42 +02:00
Dirk WetterandGitHub 916d942b00 Merge pull request #1664 from dcooper16/fix1662_3.0 
Fix #1662 in 3.0 branch
 2020-06-25 13:40:41 +02:00
Dirk WetterandGitHub 2cdcf1564b Merge pull request #1661 from csett86/wireshark-android-7-0-backport 
Add wiresharked Android 7.0 (native) (backport of #1659)
 2020-06-25 08:31:17 +02:00
Dirk WetterandGitHub 594f09e858 Merge pull request #1647 from drwetter/fix_mxs_in_get_mx_record 
Fix wrong variable declaraton in get_mx_record()
 2020-05-26 09:35:54 +02:00
Dirk 11c03790bf Fix wrong variable declaraton in get_mx_record() 
mx was declared, mxs used instead. This fixes
it by correcting the declaration.
 2020-05-25 21:28:44 +02:00
Dirk WetterandGitHub c6ca746954 Merge pull request #1634 from drwetter/dockerfile+ 
Better Dockerfile: doesn't require "git clone"
 2020-05-09 12:54:02 +02:00
Dirk e5bb789dd3 Better Dockerfile: doesn't require "git clone" 
.. see also #1559.

It "mkdirs" the needed etc and bin directories first, then copies
stuff over. It also reduces a few layers.

Also it corrects a mistake in the Readme.md (docker exec --> run)
 2020-05-09 12:48:11 +02:00
Dirk WetterandGitHub 747b1e20ac Merge pull request #1633 from unit193/3.0 
Fix a couple typos.
 2020-05-09 12:20:03 +02:00
Dirk WetterandGitHub 4e887e3ee4 Merge pull request #1628 from drwetter/bump_version302 
Bump version to 3.0.2
 2020-05-08 11:44:48 +02:00
Dirk WetterandGitHub eb1398c04c Merge pull request #1627 from drwetter/dockerhub_workaround 
Provide the correct branch to Dockerhub builds
 2020-05-08 11:36:36 +02:00
Dirk f16ed46e76 Provide the correct branch to Dockerhub builds 
... and at the same time allow correct local builds --
the default branch is 3.1dev at the moment.

It still clones the repo from github which isn't
needed. A pure copy command would be the best. However
it might cause other problems.

See also #1559
 2020-05-08 11:32:39 +02:00
Dirk WetterandGitHub e628c16155 Merge pull request #1626 from drwetter/revert-1625-dockerfile_fixtest 
Revert "Try to fix builds by Dockerhub"
 2020-05-08 10:30:42 +02:00
Dirk WetterandGitHub 1edb6159be Revert "Try to fix builds by Dockerhub" 2020-05-08 10:21:24 +02:00
Dirk WetterandGitHub 003f35d273 Merge pull request #1625 from drwetter/dockerfile_fixtest 
Try to fix builds by Dockerhub
 2020-05-07 20:44:31 +02:00
Dirk 3eba7ab0f2 Try to fix builds by Dockerhub 
see also #1559
 2020-05-07 20:42:43 +02:00
Dirk WetterandGitHub 0ba2b6e862 Merge pull request #1622 from drwetter/drwetter-patch-2 
Labelling, look @ 3.0.2
 2020-05-07 19:57:04 +02:00
Dirk Wetter b1eda9b2bf Just bump version 2020-05-07 19:55:04 +02:00
Dirk WetterandGitHub fb80e1cc44 Merge pull request #1624 from dcooper16/fix_cp_error_30 
Fix copy and paste error
 2020-05-07 19:44:16 +02:00
Dirk WetterandGitHub 0393cb42f9 Labelling, look @ 3.0.2 
* outlook to 3.0.2 (~tomorrow), remove ref. to rc
* fix docker cmd line (albeit there's still a problem w dockerhub) 
* label 3.1dev it as a ~rolling release
 2020-05-07 11:16:59 +02:00
Dirk WetterandGitHub f49d73498a Merge pull request #1617 from dcooper16/backport_1609_and_1616 
Backport #1609 and #1616
 2020-05-06 16:34:57 +02:00
Dirk WetterandGitHub 005abad35c Merge pull request #1614 from drwetter/license_patch3.0 
Amendment to "Relax the possible GPL license contradiction"
 2020-05-06 09:19:04 +02:00
Dirk 1325178f8d Amendment to "Relax the possible GPL license contradiction" 
fix it also in the man pages. See #1590 / #1592
 2020-05-06 09:12:38 +02:00
Dirk WetterandGitHub 870b78034d Merge pull request #1611 from drwetter/xmpp_improvements_3.0 
Fix STARTTLS pretests, improve XMPP handshakes (backport)
 2020-05-05 08:47:30 +02:00
Dirk Wetter 6df3f2bd4e Remove not needed if clause in starttls_io() 
.. amends 35833c1979
 2020-05-04 23:05:53 +02:00
Dirk Wetter 35833c1979 Fix STARTTLS pretests, improve XMPP handshakes (backport) 
There was a empty variable in determine_optimal_proto() which prevented to save STARTTLS_OPTIMAL_PROTO. This is fixed.

The buffers and return codes for XMPP in starttls_io() were under not every
circumstances correct. This fixes those cases and making that in general more
robust (hopefully).
 2020-05-04 23:03:01 +02:00
Dirk WetterandGitHub 47e16b08c5 Merge pull request #1607 from drwetter/1590_2 
Address further potential license restriction
 2020-05-04 20:27:52 +02:00
Dirk c5cee3ddb6 Address further potential license restriction 
.. see https://github.com/drwetter/testssl.sh/issues/1590#issuecomment-623526604

Added some formatting and verbal improvements in the intruductory comment section.
 2020-05-04 20:24:24 +02:00
Dirk WetterandGitHub 85faf9d096 Merge pull request #1606 from drwetter/add_brotli_3.0 
Add brotli compression detection for BREACH (backport)
 2020-05-04 17:50:32 +02:00
Dirk Wetter 85a529ee00 Add brotli compression detection for BREACH (backport) 
As noted in #1605 the brotli compression check was missing. So hosts
which didn't offer gzip deflate or compress but brotli seemed to
be fine but they shoould have been labled as potentially VULNERABLE.

This also fixes a bug: The HTTP header returned was only checking
for case-sensitive "Content-Encoding". RFC 2616 states in 4.2
(Message Headers): "Field names are case-insensitive"
 2020-05-04 13:23:05 +02:00
Dirk WetterandGitHub dbff0f9673 Merge pull request #1604 from drwetter/aes_cgm_doc_3.0 
Fix typo in docs: Strong grade Ciphers / AEAD
 2020-05-02 20:01:27 +02:00
Dirk e3ecd72deb Fix typo in docs: Strong grade Ciphers / AEAD 2020-05-02 19:57:02 +02:00
Dirk WetterandGitHub 5521063620 Merge pull request #1602 from dcooper16/improve_libressl_302_compat_30branch 
Improve compatibility with LibreSSL 3.0.2 and earlier
 2020-05-01 20:44:16 +02:00
Dirk WetterandGitHub ef535b6282 Merge pull request #1596 from dcooper16/ticketbleed_no_tls1_3_30branch 
Ticketbleed and TLS 1.3
 2020-04-30 13:52:27 +02:00
Dirk WetterandGitHub 3d6d1ac9d7 Merge pull request #1594 from dcooper16/ossl30_compat_for_30branch 
Improve compatibility with OpenSSL 3.0
 2020-04-29 16:14:01 +02:00
Dirk WetterandGitHub 09fe651b36 Merge pull request #1592 from drwetter/1590_readme 
Relax the possible GPL license contradiction
 2020-04-28 10:03:40 +02:00
Dirk 126e501143 Relax the possible GPL license contradiction 
... see also #1590
 2020-04-28 10:02:03 +02:00
Dirk WetterandGitHub 3c403a2484 Merge pull request #1587 from drwetter/np_fix30 
Negotiated protocol showed no warning for TLS 1.1/1.0
 2020-04-25 11:13:49 +02:00