Git/testssl.sh
1
0
Fork 0
mirror of https://github.com/drwetter/testssl.sh.git synced 2026-09-14 13:48:16 +02:00
Code Issues Packages Projects Releases Wiki Activity
292 Commits 16 Branches 39 Tags
64efb4be9479d1b85090dd5430bcf54cd1c13efe
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Dirk 64efb4be94 - FIX: 30x with BigIP doesn't have a date, handled properly now 
- generic GET/HEAD is now always with URL_PATH
 2015-05-10 23:38:06 +02:00
Dirk f0c1548c37 - informative header extended 2015-05-10 20:54:43 +02:00
Dirk 26b4a53884 - NUMEROUS FreeBSD9/Darwin FIXES #40 
- http date
  - cipher list in preferences
- GET_REQ11 now closes the connection
- openssl_age comes afeter the banner so that help doesn't need to go thru this
- uname -s ==> SYSTEM
 2015-05-10 19:20:55 +02:00
Dirk 7e1ffa2fb5 - more robust wrt IIS6 (some stuff better with IIS7) 
- X-Powered-By is easy to remove (PHP, ASP.NET), thus labelled as yellow
- same X-AspNet-Version (version # itself is brown)
- better addressed address resolution failures ;-)
- bumped up version to 2.4rc1
 2015-05-06 18:48:51 +02:00
Dirk 9a3c4bc4b9 - FIX $87 (2), finally 
- feature: integrated TLS+HTTP time into server defaults
- NEW: option: -U/vulnerable
- moved explanation for BREACH into result
- FREAK and CCS are not labled experimental anymore
- unifying of get request headers
- readability of help
 2015-05-02 15:01:02 +02:00
Dirk Wetter 31e781d229 - partly FIX for #87 (removed SNI helps. Doesn't make sense anyway) 
- changed order of Secure Renegotiation/Secure Client-Initiated Renegotiation
- readability improvements in renego
 2015-05-01 12:18:43 +02:00
Dirk 254cb24a64 - fix additional \n in RC4 if no RC4 ciphers were detected 2015-04-28 08:04:09 +02:00
Dirk Wetter 48bab2d57b Update Readme.md 2015-04-24 16:52:08 +02:00
Dirk 63ca8c6520 - more thourough what has been done 2015-04-23 09:25:28 +02:00
Dirk Wetter 7cbb8150a4 Update Readme.md 2015-04-23 08:48:28 +02:00
Dirk 3c7620bd8d - RC4 has now 2 CVEs and cipher per default are displayed short 
- introducng a variable name LONG which for certain funcs shows broad output with hexc, cipher, KX, etc.
- FIX: regression not showing security headers
- introducing VULN_THRESHLD
 2015-04-22 18:24:39 +02:00
Dirk c4bf117393 - FIX #83 
- emphasize also OS names in HTTP headers
 2015-04-22 15:22:53 +02:00
Dirk a4f1873f63 - FIX for complete bailing out 2015-04-22 11:56:13 +02:00
Dirk b5ac31c20c - reordering code so that all attacks are together 
- RC4 is now really omitted in PFS test
- cleanup of some comments
 2015-04-22 10:33:44 +02:00
Dirk c4facbbecc typo 2015-04-21 08:14:36 +02:00
Dirk 709bb758fe - better compatibility with windows 2003 server 
- all long options are advertised now as with dashes and not underscore
- cosmetic stuff
 2015-04-20 10:05:01 +02:00
Dirk 46a611ac29 FIX for #82 2015-04-18 23:03:16 +02:00
Dirk Wetter 3e2ed654c2 Indicated freeze 2015-04-16 21:05:23 +02:00
Dirk 9b1657ee06 - BUGFIX: IIS server lead to false pisitive if SSLv3 was enabled 
(timeout was faster then socket resply)
- FIX: CORS header not labeled as green
- NEW: Now also STARTTLS works with all cmd line options and is absolutely doing the same stuff!
  (integrated starttls() into parse_hn_port() )
- option --mx needed to be changed because of starttls
- regression fix: exec for socket doesn't play nice with stderr redirect
  (probably bash bug)
- added some env options to cmd line as long args (--assuming-http,--ssl_native,
  --color, debug, --sneaky, --warnings)
- threw away getent as it doesn't work under Linux && not network && localhost
  (replaced by grep)
- SSL-POODLE is not labeled anymore experimental
- HB+CCS are called while checking STARTTLS but given a hint that its not yet supported
- added more env vars to debug output
- cleanups
 2015-04-16 20:36:17 +02:00
Dirk 519f0ad699 - FIX regression: more_flags execution was missing 
- FIX regression: capitalized/all lowercase headers weren't detected
- if socksend is blocked (IDS) output looks better and is reported as test didn't succeed
- no secure cookie or Httponly will be marked as brown
- tput color yellow is now brown
 2015-04-14 13:16:43 +02:00
Dirk e0dbef62e6 - more robust grep >=2.20, e.g Debian 8.0 (thx @stevenb18) 
- FIX: false positive for breach while testing google.com (referer header was hardcoded to google.com)
 2015-04-14 10:15:07 +02:00
Dirk 40baa7c163 - FIX (regression): -V 
- logic of some ENV variables changed (attention!)
- included some ENV as long options (not in the help yet)
- decentralized http check for breach
- if openssl is not executable it bails out better now
- help function now exits
 2015-04-13 22:55:40 +02:00
Dirk 07394d2d17 Merge branch 'master' of github.com:drwetter/testssl.sh 2015-04-10 15:16:20 +02:00
Dirk b8384eceff - underline CN, SAN and issuer deutschepost case (see sourceforge.net/p/ssllabs/mailman/message/33764851/) 2015-04-10 15:15:47 +02:00
Dirk Wetter 79ee5b377a Update Readme.md 2015-04-10 10:13:30 +02:00
Dirk Wetter b670c01f36 Update Readme.md 2015-04-09 22:24:57 +02:00
Dirk b0c68d4429 FIX: missing server preferences, NEW: each cipher server preferences per protocol! 2015-04-09 22:08:48 +02:00
Dirk 9945ef0e81 - 2015-04-09 21:45:22 +02:00
Dirk 5051eb3d5d - fixes to changes from Peter's better cmd line parsing 
- cosmetc improvements (vulneraibilities)
 2015-04-09 21:42:52 +02:00
Dirk Wetter cb98920733 Merge pull request #79 from PeterMosmans/refactoring 
Refactored major parts of code
 2015-04-09 21:38:29 +02:00
Dirk 44b31a1c54 FIX #80: show HTTP 401 2015-04-02 13:35:22 +02:00
Dirk 80f932ca30 NEW: added security headers 2015-04-02 13:04:57 +02:00
Dirk 9ea84ee6ec - got rid of "strings" 2015-04-02 12:19:24 +02:00
Dirk 348f651fc8 - updated binaries from Peter. Necessary because handshake under rare circumstances 
failed (routines:tls1_setup_key_block:cipher or hash unavailable:t1_enc.c:802.
  SLES 12 server, some ciphers under TLS 1.2
 2015-04-02 11:46:12 +02:00
Dirk 7b9c125046 protocol check via sockets now also for SSLv3 2015-03-31 10:34:30 +02:00
Dirk 5e9bb1c7e2 cleanups / bsd date in tls time 2015-03-30 23:09:19 +02:00
Dirk 74b6bd7241 rechi 2015-03-30 15:03:29 +02:00
Dirk 9bd1b44270 open fixes from Rechi (pull request $67) 2015-03-30 14:59:44 +02:00
Dirk Wetter 77fd58e556 Merge pull request #75 from feld/tr 
Using square brackets in tr results in trying to match/replace them
 2015-03-19 09:14:54 +01:00
Dirk Wetter c0e6777666 Merge pull request #76 from feld/printf 
Fix variable directly referenced in printf
 2015-03-19 09:14:32 +01:00
Dirk 7157d094bb Дилян 2015-03-17 22:14:05 +01:00
Dirk 485f0f8080 - FIX for 3des cipher report (thx Дилян) 2015-03-17 22:12:25 +01:00
Dirk 1de535cc25 - added two pairs of ciphers to server preference (thx Dilian) 2015-03-17 22:02:23 +01:00
Dirk 79396acf97 - working tls handshake with bash sockets (not yet in production, hint: see option "-q" in the bottom) 2015-03-17 18:11:18 +01:00
Dirk c4877799ec - check whether openssl is executable 
- spaces to tabs
- adding hint to "aha" in help
 2015-03-17 15:14:58 +01:00
Dirk 761e854610 - FIX for date --> applied to other BSD systems too 
- FIX for SNI output as it doensn';t make sense for non HTTP servives
- lines for RC4 and PFS shortenedA
- display all MX records to test before testing
- removed LOCERR, added CCS_MAX_WAITSOCK, HEARTBLEED_MAX_WAITSOCK
 2015-03-17 12:22:21 +01:00
Dirk c8090600b6 - some internal code internal cleanups 
- minor cosmetic output corrections
- preparation for bash sockets for SSLv3 to TLS 1.2
 2015-03-16 00:22:51 +01:00
Dirk 41c4ed94c1 further improvements through shellcheck 2015-03-15 16:59:29 +01:00
Dirk 639258cfe0 FIX #74 for sed BSD: doesn't like inline \n 
headline for BEAST was missing
 2015-03-15 16:10:14 +01:00
Dirk c2ece82d9b - FIX: regression for wc -l w/o cat (3x) 
- removal of unneccessary waitpid, inline
 2015-03-15 14:41:34 +01:00
Dirk bdd0602c1f - prework for checking hpkp fingerprints 2015-03-15 10:18:37 +01:00
Dirk 7d43dd7c8a - Shellcheck static analysis by Mark 2015-03-15 09:04:49 +01:00
Dirk Wetter 06268de428 Merge pull request #73 from feld/master 
Shellcheck static analysis
 2015-03-15 08:56:01 +01:00
Dirk d31b517b31 - @feld 2015-03-13 12:21:06 +01:00
Dirk dc05ff9b13 - FIX garbled output for servers with a TLS reply on SSLv2 socket call 2015-03-13 12:20:19 +01:00
Dirk Wetter 1ca03e3ed9 Merge pull request #72 from feld/feld 
Minor optimizations to reduce unnecessary forking
 2015-03-13 11:00:52 +01:00
Dirk 7348093a12 FIX for #71 (proper workaround for lastpipe in rc4, pfs, and cbc) 2015-03-09 08:07:45 +01:00
Dirk 8b67fa3889 - NEW: proper check for freak CVE-2015-0204 
- NEW: check for number of keys for hpkp
- cleanup hsts+hpkp
 2015-03-07 09:51:55 +01:00
Dirk 48f5d6db87 - MX record: the lower the # the higher the priority (thx, rechi) 2015-03-03 07:21:30 +01:00
Dirk 8288bbd375 - see #41 2015-03-02 14:44:02 +01:00
Dirk 2d6c087f84 - finalize mx records, FIX: #41 2015-03-02 14:42:28 +01:00
Dirk Wetter 21f3cbf009 Merge pull request #66 from Rechi/master 
Check MX Records (#41)
 2015-03-02 14:13:33 +01:00
Dirk 4e4e85fe96 - remark about rc4 rfc 2015-03-02 14:09:34 +01:00
Dirk Wetter c279fb90b7 Update Readme.md 2015-03-02 13:59:45 +01:00
Dirk 694d579110 - better detection for ssl poodle 
- change of shorticut from zero to letter o
 2015-02-27 21:21:39 +01:00
Dirk Wetter d7c2dedd06 Merge pull request #65 from schuetzm/fix-nrsaved 
Don't let error message slip through when no certs have been downloaded
 2015-02-24 18:28:09 +01:00
Dirk Wetter c8e3bce79a Merge pull request #64 from PeterMosmans/spellingfix 
FIX: minor spelling issue
 2015-02-24 10:03:32 +01:00
Dirk f193a0e5b0 - FIX #62 (CentOS 7/RHEL: engine failure), was not usable b4 2015-02-23 10:40:10 +01:00
Dirk affac236ca - FIXED: #47 ("double" linefeed if RFC mapping file is not present) 2015-02-22 23:05:40 +01:00
Dirk 4e863e4fa5 - NEW: tells how many certificates provides (and grabs them with DEBUG=1) 
- COLOR for no cipher order is red now
- "VULNERABLE" comes now always with "NOT ok"
 2015-02-21 11:47:12 +01:00
Dirk d16939ea8f - FIXED: #38, new openssl from Peter Mosmans makes the workaround unneccessary 2015-02-21 10:46:30 +01:00
Dirk 14385bf435 - to tell the difference between the sets of binaries 2015-02-21 10:39:27 +01:00
Dirk 31262a1011 - FIXED: #38, new openssl from peter mosmans makes the workaround unneccessary 2015-02-21 10:38:04 +01:00
Dirk Wetter 97337cb142 Update Readme.md 2015-02-15 14:10:11 +01:00
Dirk 966b75a893 - Fix #55 (302 detection for URL) 2015-02-15 14:00:13 +01:00
Dirk 5ea0b8c281 - Fix #46 (preload lists HPKP and HSTS) 
- word match for includeSubDomains (useful if one specified the keyword wrong)
 2015-02-15 13:37:44 +01:00
Dirk 388ffa8fe0 - FIX #60: mod_security CRS doesn't complain anymore 2015-02-15 13:14:11 +01:00
Dirk 07fbb8c8f0 - certificate sha2 fingerprint added (#59, @@kyhwana) 
- sha1 fp: removed colons as long serials after it look ugly (lf)
 2015-02-15 12:58:51 +01:00
Dirk 6d37c9a3c5 - workaround for issue #58, same in http_header 
- FIX: if a web site returned IMAP e.g. in HTML code it may have led to the assumption IMAP is the service ;-/
 2015-02-13 16:01:46 +01:00
Dirk e031ec83ed - FIX regression: CRIME check 
- FIX: port ended up sometimes as URL part
- also if it runs http a line is displayed as confirmation that HTTP was detected
 2015-02-12 13:40:53 +01:00
Dirk 8a94b05bc6 - new build with proper banner string 2015-02-12 11:12:49 +01:00
Dirk Wetter 8d06f03f0b Update Readme.md 2015-02-12 10:50:52 +01:00
Dirk Wetter 43fe25188a Update Readme.md 2015-02-12 09:45:26 +01:00
Dirk b7911371d1 - WORKAROUND for bug in PeterMosmans OPENSSL chacha/poly version: not testing EXPORT40/EXPORT then 2015-02-12 09:32:47 +01:00
Dirk 8e9b07e72d - NEW: check for Secure Client-Initiated Renegotiation 
- debugging #1: PS4 and debugme
- debugging statement tmpfile_handle where missing #2
 2015-02-11 09:43:04 +01:00
Dirk Wetter a2b4319571 Update Readme.md 2015-02-10 13:18:02 +01:00
Dirk 98f035f9e3 - sha2 like mozilla 2015-02-10 12:43:08 +01:00
Dirk 2a70c5ca01 Merge branch 'master' of github.com:drwetter/testssl.sh 2015-02-10 12:40:14 +01:00
Dirk Wetter cb64eacbb1 Update Readme.md 2015-02-10 12:39:54 +01:00
Dirk Wetter ad4d2308bd Update Readme.md 2015-02-10 12:39:20 +01:00
Dirk Wetter 4ee7abb863 Update Readme.md 2015-02-10 12:39:02 +01:00
Dirk 5683e1bf14 - vanilla as a workaround for bug #38 2015-02-10 12:37:03 +01:00
Dirk Wetter 0181d3b349 Update Readme.md 2015-02-10 12:34:35 +01:00
Dirk Wetter d35753414a Update Readme.md 2015-02-10 12:20:59 +01:00
Dirk Wetter 027c8c2867 Update Readme.md 2015-02-10 12:00:02 +01:00
Dirk Wetter 21819b7996 Update Readme.md 2015-02-10 11:59:47 +01:00
Dirk fb7f7df545 - starttls for ldap now also supported 2015-02-09 14:02:02 +01:00
Dirk Wetter 141dc946aa Merge pull request #57 from schuetzm/patch-1 
Trivial typo fix
 2015-02-09 13:52:11 +01:00
Dirk Wetter 8af51737c4 Update Readme.md 
Bug #38
 2015-02-05 10:06:27 +01:00
Dirk Wetter e296e47cbf Delete openssl32-1.0.2pm.chacha+poly 2015-02-05 10:02:54 +01:00