Commit Graph

3300 Commits

Author SHA1 Message Date
Dirk af94d46232 minor additions wrt LibreSSL and OpenBSD 2017-09-27 09:26:36 +02:00
Dirk e32479818d mentioning BiGIP cookies and MongoDB 2017-09-27 09:25:22 +02:00
Dirk Wetter ce0a00be37 reordered features 2017-09-27 09:07:21 +02:00
Dirk Wetter fa5700644b Merge pull request #837 from sdann/mongodb_detection
Add support for MongoDB service detection
2017-09-27 08:37:58 +02:00
Steven Danneman ee0ba18995 Add support for MongoDB service detection
MongoDB listens on port 27017 and will respond to a direct TLS
ClientHello without the need for STARTTLS. Thus, testssl.sh already
mostly works to scan a MongoDB server.

The problem is that MongoDB will also reply to an HTTP GET request with
a mocked up HTTP response, which was tricking the tool into believing it
was dealing with an HTTP server. The response looks like this:

---
HTTP/1.0 200 OK
Connection: close
Content-Type: text/plain
Content-Length: 84

It looks like you are trying to access MongoDB over HTTP on the native
driver port.
---

Thus, the detection algorith must first look for HTTP, then dig deeper
into the body looking for "MongoDB".

The tool output now says:

Service detected:       MongoDB, thus skipping HTTP specific checks
2017-09-26 15:57:28 -07:00
Dirk Wetter 5a6646ca98 f5 cookie 2017-09-25 22:07:40 +02:00
Dirk Wetter 2c76025ade Merge pull request #836 from drwetter/bigip
F5 cookie detection
2017-09-25 20:02:03 +02:00
Dirk dbab397645 finalized work on integrating my f5 cookie decoder
see https://github.com/drwetter/F5-BIGIP-Decoder
2017-09-25 19:51:10 +02:00
Dirk f6cf96d916 polish help for -g option 2017-09-23 12:54:44 +02:00
Dirk 68509694d4 NO_ENGINE (#834) and GREASE (#814) 2017-09-23 11:55:09 +02:00
Dirk 4523eea398 More LibreSSL patches
As dcooper16 noted in #834 there are checks which test for openssl versions
but don't take LibreSSL in account. This adds checks to it for several
LibreSSL versions (>=2.1.x) which are known to support ``determine_trust()``
and it HAS_DH_BITS.

Moreover engine check has been improved. Older LibreSSL versions (2.1 specifically)
had different error messages, so the previous checks failed. There's also
a CMD_LINE flag now where one can switch the engine support off: NO_ENGINE .

run_renogo from #834 is still an open issue.
2017-09-23 11:34:37 +02:00
Dirk 695d02157a FIX #829 (OpenBSD fixes)
All three issues fixed. Terminal code were actually
tow problems: Logging in from Linux with a 256 color xterm
makes tput set AF from  OpenBSD hiccup. And the detection
of not-ncurses style underline e.g. was not working under OpenBSD.

The engine fix was done by David Cooper (see #831).

There's also a name of the binary now (OpenSSL/LibreSSL) for tracking
the flavor used.
2017-09-22 18:48:38 +02:00
Dirk d3c3d65e1f wording client simulation 2017-09-22 10:32:28 +02:00
Dirk 3abbddbad7 F5 cookie detection works for testcases. Output needs to be worked on 2017-09-21 10:19:47 +02:00
Dirk Wetter 3e69304e6d Merge pull request #828 from dcooper16/correct_typos
Correct typos
2017-09-20 20:06:59 +02:00
David Cooper a6f7121d25 Correct typos 2017-09-20 12:10:29 -04:00
Dirk a330fafb3b regression fix: output for CVE-2015-3197 was missing in DROWN 2017-09-20 17:22:54 +02:00
Dirk 84c112561b workaround due to problem with blanks in $SWURL
SWURL contained for historical reasons trailing blanks
for released versions.
This caused an error in pr_boldurl --> html_out which
didn't write the trailing style info and didn't close
the href tag (travis complained.)

This patch removes the trailing blank but it doesn't
fix the error.
2017-09-20 10:56:33 +02:00
Dirk 02f4f1bae1 reflect GREASE commit by David 2017-09-19 17:34:22 +02:00
Dirk Wetter 55db191a2d Merge pull request #814 from dcooper16/grease
GREASE
2017-09-19 17:24:00 +02:00
David Cooper 49a4133979 GREASE
This is an initial implementation of the idea I proposed in #791. It includes checks based on draft-ietf-tls-grease as well as checks for specific implementation bugs that have previously been encountered.

This code needs testing. While I know of one server that will fail if the ClientHello contains more than 128 ciphers, I haven't been able to test any of the other code against any servers that have the tested-for bugs.

In addition, there is a need for polishing. The tests are referred to as `--grease`, which may not be a very user-friendly name. In addition, there is no output providing information about what tests are being performed. If a server fails a test, then a warning message is printed and is sent to `fileout()`. If the server passes all of the tests, then there is just a single output of "No bugs found."

At the moment, the code is not run by default. Unless `-g` or `--grease` is explicitly included in the command line, the code in this commit is not executed.
2017-09-19 09:18:46 -04:00
Dirk b9b09f586e added MS CA store, see #825
Finally complete, thx @naumanshah03
2017-09-19 15:15:54 +02:00
Dirk Wetter f48deaaa9d Update README.md 2017-09-19 14:50:08 +02:00
Dirk 4972cda2af FIX #762 (replace which by 'type -p') 2017-09-19 00:08:33 +02:00
Dirk 1c10ad0124 remove echoing ~ /usr/bin/timeout 2017-09-18 23:38:06 +02:00
Dirk b222fe8f53 Merge branch '2.9dev' of github.com:drwetter/testssl.sh into 2.9dev 2017-09-18 23:34:12 +02:00
Dirk Wetter 95af735862 Update README.md 2017-09-18 23:33:25 +02:00
Dirk Wetter 3caa73c1b8 Update README.md 2017-09-18 23:32:35 +02:00
Dirk bd55830a7e FIX #823, for jabber try PTR record first or fail 2017-09-18 23:25:07 +02:00
Dirk f014a1853b missing update from 985c845486 2017-09-18 23:01:37 +02:00
Dirk Wetter 7294df927f Merge pull request #677 from dcooper16/no_sni
Just get non-SNI certificate once
2017-09-18 21:14:34 +02:00
David Cooper 34fa8fc98e Just get non-SNI certificate once
Currently the call to `$OPENSSL s_client` to obtain the certificate returned by the server when SNI is not provided is in `certificate_info()`, which means that it is called once for each certificate found the various called to `get_server_certificates()`.

This PR moves the call to `$OPENSSL s_client` to `run_server_defaults()` so that the call is made only once, even if more than one server certificate was found.

In addition, in most cases the certificate returned by the server when SNI is not provided will already have been retrieved by `run_server_defaults()` (in rounds 8-14), in which case `$HOSTCERT.nosni` can just be copied from there rather than making an additional call to `$OPENSSL s_client`.
2017-09-18 13:31:38 -04:00
Dirk Wetter a395f91f0e Merge pull request #777 from dcooper16/fix772
Fix #772
2017-09-18 18:36:53 +02:00
Dirk 6b1d81d28d imor housekeeping for ``fileout()`` in ``run_http_header()`` 2017-09-18 18:18:05 +02:00
Dirk Wetter 200440a28f Merge pull request #820 from seccubus/insecure_redirect
Fixed file output error in case of insecure redirect
2017-09-18 18:01:43 +02:00
Dirk f372b4b775 FIX #622
If the host negotiated SSLv3 reading of the ServerKeyExchange message failed
and as a consequence determination of the DH key
2017-09-18 17:50:06 +02:00
David Cooper a264898f77 Initial fix for #772
This commit provides a partial fix for #772.
2017-09-18 09:52:30 -04:00
Dirk 8b076e9841 relect what to do for updtaing ca_hashes.txt 2017-09-18 14:20:56 +02:00
Dirk 985c845486 update of certificate stores, except MS 2017-09-18 14:18:00 +02:00
Dirk 26c77cc3c2 any openssl will do 2017-09-18 14:02:12 +02:00
Dirk c4e5533ab0 FIX #822 2017-09-15 21:20:42 +02:00
Dirk 837a6fb31c fix travis build in fad8c63 2017-09-15 15:38:11 +02:00
Dirk fad8c631ef consistently open the file with echo here as well
see CSVFILE (and request #822)
2017-09-15 15:09:13 +02:00
Dirk Wetter 90cd8cd3e2 Merge pull request #796 from sdann/mysql_standard_cipher
Catch MySQL (yaSSL) server bug when testing standard cipher categories
2017-09-15 14:02:26 +02:00
Frank Breedijk 49ed49f505 Fixed file output error in case of insecure redirect 2017-09-11 16:59:34 +02:00
Dirk 50287ef2c4 fix for empty/malformed socket replies
During protocol check if a sever answered unexpected with
closing the conenction or another malformed reply the
output was not ok as DETECTED_TLS_VERSION was empty.

This fixes it by filling the variable with a string in ``parse_tls_serverhello()``
and then check in higher level (``run_protocols()``) the content.

Also it seems that I forgot in the commit from yesterday one ``&&`` to
commit in ``run_breach()``
2017-09-01 16:13:32 +02:00
Dirk ee8c5e51a1 fix vulnerability output for breach and x509 based client auth
and polish output in ``run_renego()``
2017-08-31 17:22:10 +02:00
Dirk 9345b55865 added ALL_CLIENTS for client siumulation 2017-08-30 23:40:47 +02:00
Dirk Wetter 25f1293756 client simulation update
file renamed (dash is more consistent)

env var "ALL_CLIENTS" now shows every browser (or client) during
client simulation
2017-08-30 23:04:52 +02:00
Dirk Wetter 4379174970 rename generated file, comment it better + take care of one GREASE cipher 2017-08-30 23:02:21 +02:00