Git/testssl.sh
1
0
Fork 0
mirror of https://github.com/drwetter/testssl.sh.git synced 2026-09-14 13:48:16 +02:00
Code Issues Packages Projects Releases Wiki Activity
4,855 Commits 16 Branches 39 Tags
84e77d2bb090912f984969b1fa2bfd3da9ef6ae7
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Dirk 84e77d2bb0 Java 21 2025-04-09 17:07:19 +02:00
Dirk 31e2f43eec LibreSSL update 3.3.6 (MacOS) 
.. renaming that to macOS instead "Apple".
 2025-04-09 16:51:26 +02:00
Dirk 4f696f94df Add openssl 3.0.15 (from Debian) 
... and set OpenSSL 3.0.3 (git) as not to list
 2025-04-09 16:39:05 +02:00
Dirk e4cdca9e63 Add Safari 18.4 @ MacOS 15.4 2025-04-09 15:53:11 +02:00
Dirk d601f33a37 Merge branch '3.2' into new_Handshakes 2025-04-09 10:59:40 +02:00
Dirk WetterandGitHub bc0c9f9c4b Merge pull request #2733 from dcooper16/ossl35_client_sim 
OpenSSL 3.5.0 client simulation
 2025-04-09 10:46:20 +02:00
Dirk 0d7c33ab7f deprecate more 
- Safari 12.1 (iOS 12.2)
- Firefox 66 (Win 8.1/10)
 2025-04-08 16:14:37 +02:00
Dirk 887653a033 Deprecate a few entries ... 
- Android 5+6
- Chrome 79 Win 10
- IE 6 XP
- IE 8 XP
- Safari 13.0 (macOS 10.14.6)
- OpenSSL 1.1.0l (Debian)

... before new ones are added
 2025-04-08 16:06:55 +02:00
Dirk 7939144af1 Swap Android 6 for Android 5 
... as it seems to habe more market share
 2025-04-08 15:49:44 +02:00
Dirk 58ddfd8a24 Add hint for JA3/4 
+ minor corrections
 2025-04-07 19:38:05 +02:00
Dirk 45be26db7c Add Java 8u442 handshake 
Also the ja3 and ja4 values were added as retrieved from wireshark.

See also #2430 .
 2025-04-07 19:36:34 +02:00
Dirk WetterandGitHub 06682990ba GHCR clearer 2025-04-06 20:29:18 +02:00
Dirk WetterandGitHub f7f35fe4c6 Merge pull request #2729 from testssl/ghcr.io-doc 
Add minimal doc for GHCR
 2025-04-06 18:29:07 +02:00
Dirk Wetter ac0419eaad Add minimal doc for GHCR 2025-04-06 18:27:37 +02:00
Dirk WetterandGitHub b20add1d12 Merge pull request #2684 from testssl/new_binaries 
Start working on a set of new binaries
 2025-04-04 14:15:00 +02:00
Dirk WetterandGitHub b7f9ff1bf2 Merge pull request #2727 from dcooper16/chacha20 
ChaCha20 decryption
 2025-04-04 11:54:05 +02:00
Dirk WetterandGitHub be9a85c1f7 Merge pull request #2726 from dcooper16/fix_has_uds_checks 
Fix checks with HAS_UDS and HAS_UDS2
 2025-04-02 21:47:41 +02:00
Dirk 672d253981 Fix typo 2025-04-01 18:58:12 +02:00
Dirk b149fc4da4 Reorder, rephrase, timing 
Also provide a runtime table, from a little research.
 2025-04-01 15:24:40 +02:00
Dirk 45a264e4e4 Fix typo 2025-03-31 18:08:27 +02:00
Dirk f55abf56af Add new 64 Bit binaries (Linux, FreeBSD) 
... from https://github.com/testssl/openssl-1.0.2.bad .
 2025-03-31 17:54:40 +02:00
Dirk 093e8ddd10 Remove redundant statements 2025-03-31 17:54:01 +02:00
Dirk WetterandGitHub 2dfd192f27 Typos / when needed 2025-03-30 19:59:23 +02:00
Dirk 3a414d60bf Comment the removal of binaries 2025-03-30 18:14:41 +02:00
Dirk f208c09803 Rename file 2025-03-30 18:11:21 +02:00
Dirk 0e765986dc Remove output from openssl Kerberos binary 
... as we don't supply the kerberos binary anymore
 2025-03-30 18:08:58 +02:00
Dirk 1852ef6a1d Remove 32 Bit Linux binary 
... as it is a niche thing. It might be available @ the contibuted
build directory @ https://testssl.sh
 2025-03-30 18:06:58 +02:00
Dirk 5a1d90f310 Fix link 2025-03-28 18:33:14 +01:00
Dirk WetterandGitHub a348839f60 Merge pull request #2720 from testssl/add_comment_get_server_cert 
Comment the first lines get_server_certificate()
 2025-03-25 21:56:32 +01:00
Dirk Wetter 040ef1e0c9 Comment the first lines get_server_certificate() 
See https://github.com/testssl/testssl.sh/issues/2707#issuecomment-2741053487
 2025-03-25 17:22:10 +01:00
Dirk WetterandGitHub 5359befc60 Merge pull request #2716 from testssl/sanitze_http_header_better 
Sanitze HTTP header early and better
 2025-03-20 15:44:28 +01:00
Dirk Wetter a17bb42a37 Sanitze HTTP header early and better 
On MacOS `run_http_header()` hiccuped when in any place of the web site unprintable chars were returned, see https://github.com/testssl/testssl.sh/issues/2708#issuecomment-2738347784 .

This PR fixes that by moving the sanitization to a separate function and run it earlier before any processing of the returned content (header plus body) takes place.

Output was:

```
'HTTP Status Code           awk: towc: multibyte conversion failure on: '� disabilitato");

 input record number 36, file /tmp/testssl.FHu8E0/AAA.BBB.CCC.DDD.http_header.txt
 source line number 1
'wk: towc: multibyte conversion failure on: '� disabilitato");

 input record number 36, file /tmp/testssl.FHu8E0/AAA.BBB.CCC.DDD.http_header.txt
 source line number 1
  200 OK
```
 2025-03-20 13:34:46 +01:00
Dirk WetterandGitHub 692b9c9260 Merge pull request #2710 from testssl/fix_2708_TLS_FALLBACK_SCSV 
Set POODLE var when exiting run_ssl_poodle()
 2025-03-20 10:45:57 +01:00
Dirk WetterandGitHub 70dacdf9fa Merge pull request #2709 from testssl/nameopt_utf8_2705 
Fix LibreSSL parsing (-nameopt utf8)
 2025-03-19 23:41:47 +01:00
Dirk Wetter e4bbd6b517 Set POODLE var when exiting run_ssl_poodle() 
... so that run_tls_fallback_scsv() doesn't exit with a warning.

This fixes #2708 .
 2025-03-19 23:30:06 +01:00
Dirk Wetter 8d8f83ace5 Fix LibreSSL parsing (-nameopt utf8) 
When parsing the intermediate cerificates there was a parser problem when using
LibreSSL and not OpenSSL.

This PR fixes the issue #2705 and addresses the problem by using the -nameopt multiline command
of LibreSSL/OpenSSL .
 2025-03-19 22:36:37 +01:00
Dirk WetterandGitHub a43261fc6f Merge pull request #2703 from dcooper16/ocsp_check_rev_ossl_ver 
OpenSSL version check in check_revocation_ocsp()
 2025-03-18 13:04:23 +01:00
Dirk WetterandGitHub 0c64e09203 Merge pull request #2702 from testssl/dependabot/github_actions/docker/login-action-3.4.0 
Bump docker/login-action from 3.3.0 to 3.4.0
 2025-03-17 10:26:57 +01:00
Dirk WetterandGitHub 87d57bbf2f Merge pull request #2700 from testssl/unitttest_revocation 
Unit test revocation
 2025-03-15 21:38:57 +01:00
Dirk 52476b8a46 Fix finger confusion ;-) 2025-03-15 17:27:28 +01:00
Dirk c7e095305f Add unit test for certificate revocation 
One positive, one negative

This should detect failures in the future like in #2667, #2516
and #1275 .
 2025-03-15 17:24:22 +01:00
Dirk WetterandGitHub 2090bdc849 Merge pull request #2698 from testssl/fixDockerOcspCall 
Fix --phone-out + ocsp, also in docker container
 2025-03-15 17:11:52 +01:00
Dirk 633503cd17 Fix complaint wrt Lowercase "as" 2025-03-15 16:02:32 +01:00
Dirk 430c5c8d09 Fix --phone-out + ocsp, also in docker container 
Previously in 4f1a91f92e there was a
double header sent to the server to check whether the certificate
was revoked.

This PR addresses that and fixes #2667 .
 2025-03-15 15:58:28 +01:00
Dirk WetterandGitHub 098aa4ad8b Merge pull request #2697 from dcooper16/fix_ossl_version_check 
Fix OpenSSL version check
 2025-03-15 09:22:26 +01:00
Dirk WetterandGitHub 73be4f7381 Merge pull request #2695 from testssl/fix_segfault_error4 
Fix segfault with error 4 in check_revocation_ocsp() when using --phone-out
 2025-03-14 19:19:38 +01:00
Dirk 4f1a91f92e Fix segfault with error 4 in check_revocation_ocsp() when using --phone-out 
As `--phone-out` sometimes doesn't work with our binary we switch transparently/automagically
to the vendor support openssl binary -- if available.

This fixes at least #2516 where the issue has been explained/debugged in detail.
See also #2667 and #1275.
 2025-03-14 17:06:42 +01:00
Dirk WetterandGitHub c53f4a3e44 Merge pull request #2682 from testssl/speedup_curvetests 
Speed up startup checks for supported curves and more
 2025-03-13 10:59:42 +01:00
Dirk WetterandGitHub 31a09ec593 Merge pull request #2692 from testssl/more_extension_numbers 
Add a few extension numbers in the server hello
 2025-03-12 10:29:15 +01:00
Dirk WetterandGitHub cab5bd7b13 Merge pull request #2694 from dcooper16/changes_update 
Update CHANGELOG.md and CREDITS.md
 2025-03-12 10:27:31 +01:00
Dirk WetterandGitHub 1e63bd296d Merge pull request #2693 from testssl/drwetter-patch-1 
Update pull_request_template.md
 2025-03-11 16:25:19 +01:00
Dirk WetterandGitHub 011bcc7223 Update pull_request_template.md 2025-03-11 16:21:24 +01:00
Dirk WetterandGitHub bad917f193 Update pull_request_template.md 2025-03-11 16:20:25 +01:00
Dirk 8b00ab4c47 Add a few extension numbers in the server hello 
Issue #2686 showed a server which listed an unknown extension number from
RFC 8446. THis PR adds this number and a few (later) ones.

It just lists them when detected in `parse_tls_serverhello()`

See also https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml
 2025-03-11 15:57:25 +01:00
Dirk WetterandGitHub 830af44953 Merge pull request #2690 from dcooper16/mlkem 
Support draft-connolly-tls-mlkem-key-agreement
 2025-03-11 15:33:22 +01:00
Dirk WetterandGitHub 70e1c4d693 Merge pull request #2689 from dcooper16/sort_tls_extns 
Sort TLS extensions
 2025-03-11 15:20:36 +01:00
Dirk WetterandGitHub 6ed6db500b Merge pull request #2688 from dcooper16/ossl4_compat 
OpenSSL 4 compatibility
 2025-03-11 15:16:45 +01:00
Dirk WetterandGitHub ac83b79680 Merge pull request #2687 from dcooper16/ossl35_compat 
OpenSSL 3.5 compatibility
 2025-03-11 15:13:44 +01:00
Dirk 9817041519 Fix typo 2025-03-06 13:41:56 +01:00
Dirk 696ec07a42 Start working on a set of new binaries 
* Update Readme
* Remove Kerberos binary (will go to https://testssl.sh/)
* Remove other old files
 2025-03-06 13:36:31 +01:00
Dirk WetterandGitHub f34b81ed8f Merge pull request #2683 from testssl/drwetter-patch-1 
Update pull_request_template.md
 2025-03-06 11:16:01 +01:00
Dirk WetterandGitHub b25038e248 Update pull_request_template.md 2025-03-06 11:14:54 +01:00
Dirk 4a8377a396 Conflicts resolved 2025-03-06 11:01:00 +01:00
Dirk WetterandGitHub 08d8039813 Merge pull request #2681 from testssl/date_not_available 
Fix regex for openssl banner
 2025-03-05 22:20:42 +01:00
Dirk 7bb04e020e Fix regex for openssl banner 
,,, and also update the warning when runing in SSL native mode to check the ciphers
before and include OpenSSL also
 2025-03-05 17:52:34 +01:00
Dirk f03440bc28 Speed up startup checks for supported curves and more 
In order to avoid delays due to lookups of the hostname "invalid." we
just avoid to use "invalid." whenever possible. :-)

Therefore we just do a test before whether `$OPENSSL s_client 2>&1 </dev/null`
does a connect, except when a WSL system is discovered. If that succeeds
we omit the part `-connect invalid.` to check whether the curve is supported.
In some quick testing this in fact improved the startup time.

This seemed to work under Linux with several openssl and one LibreSSL binary.
More testing would be required, especially e.g. under WSL / WSL2.

Also in `sclient_supported()` the `$OPENSSL s_client` statement was changed
in a similar fashion. That worked so far but would need to be observed more
closely.
 2025-03-05 17:22:01 +01:00
Dirk WetterandGitHub 9807bc327a Merge pull request #2679 from testssl/banner_change 
Banner change
 2025-03-05 16:28:29 +01:00
Dirk e6cfe8c3b0 Resolve merge conflict by incorporating both suggestions 2025-03-05 15:35:18 +01:00
Dirk e2ee8b24b4 fix typo in comment 2025-03-05 15:06:41 +01:00
Dirk 5ffcd086eb Add missing local vars 2025-03-05 15:02:15 +01:00
Dirk 3152cdf864 Banner change + minor fix for curve detection 
In order to tell openssl binaries better apart the short banner below the
hash tag signs contain now also the date. That is the short version of the
build date unless it is not supplied which is the case of opensuse. Then
the name contains the date and it's taken from there.

The start and end banner lines have the same length now.

"sieve" was added in a comment and the sequence where sieve appears in
a pattern was trying to match other occurences (i.e. after nntp)

While testing the banners it appeared under Linux that a) the vendor
supplied openssl sometimes hangs during startup when determining the
supported curves using -connect b) a pattern was missing to detect
whether the curve was not supported which falsely labeled all supplied curves
as supported when using /usr/bin/openssl . The pattern for the latter
was added (b). For a) there needs to be a follow up PR to avoid the
long delays.
 2025-03-05 14:41:12 +01:00
Dirk WetterandGitHub f555fb050e Merge pull request #2678 from dcooper16/fix_typo 
Fix typo
 2025-03-05 09:13:12 +01:00
Dirk WetterandGitHub 3ae276497d Merge pull request #2677 from testssl/dependabot/github_actions/docker/setup-qemu-action-3.6.0 
Bump docker/setup-qemu-action from 3.5.0 to 3.6.0
 2025-03-03 09:49:25 +01:00
Dirk WetterandGitHub 4fde2e7e49 Merge pull request #2674 from testssl/dependabot/github_actions/docker/build-push-action-6.15.0 
Bump docker/build-push-action from 6.14.0 to 6.15.0
 2025-02-27 10:32:27 +01:00
Dirk WetterandGitHub 105c19e4ef Merge pull request #2675 from testssl/dependabot/github_actions/docker/setup-qemu-action-3.5.0 
Bump docker/setup-qemu-action from 3.4.0 to 3.5.0
 2025-02-27 10:32:03 +01:00
Dirk WetterandGitHub c9d1ba4fcc Merge pull request #2673 from dcooper16/avoid_subshell 
Avoid subshell overhead
 2025-02-27 10:31:04 +01:00
Dirk WetterandGitHub 78dd0a13c9 Merge pull request #2671 from javabrett/javabrett/improve-ev-detection 
Improved (experimental) Extended Validation (EV) certificate identification
 2025-02-26 22:56:21 +01:00
Dirk WetterandGitHub 04e5bc4be9 Merge pull request #2672 from javabrett/patch-1 
Update CONTRIBUTING.md
 2025-02-26 10:23:26 +01:00
Dirk WetterandGitHub ff41cbbb89 Merge pull request #2669 from magnuslarsen/3.1dev 
fix(rating): explicit enable rating if required vuln-checks are enabled
 2025-02-23 14:29:18 +01:00
Dirk WetterandGitHub 69e2067b99 Merge pull request #2666 from krufab/fix/fix-typo-in-help-message 
Corrected typo in the help message
 2025-02-22 16:00:31 +01:00
Dirk WetterandGitHub ffa3e19764 Merge pull request #2662 from dcooper16/fix_ossl_supported_curve_check 
Fix check for OpenSSL supported curves
 2025-02-20 11:30:10 +01:00
Dirk WetterandGitHub 94ff89671f Merge pull request #2664 from testssl/dependabot/github_actions/docker/build-push-action-6.14.0 
Bump docker/build-push-action from 6.13.0 to 6.14.0
 2025-02-20 11:29:28 +01:00
Dirk WetterandGitHub 74209e05de Merge pull request #2660 from testssl/rm_comment 
Remove obsolete comment that SNI is not needed for ticketbleed
 2025-02-17 15:39:26 +01:00
Dirk WetterandGitHub 2baaf61cc5 Merge pull request #2657 from dcooper16/fix_pattern_match 
Fix pattern matches
 2025-02-15 14:14:38 +01:00
Dirk WetterandGitHub f085fd1880 Merge pull request #2659 from dcooper16/npn_sockets 
Enable run_npn() to use tls_sockets()
 2025-02-15 13:47:13 +01:00
Dirk e79dc8161e Remove obsolete comment that SNI is not needed for ticketbleed 
See also https://github.com/testssl/testssl.sh/pull/2656/files/aa5d4917cfc04f5fb2f6b57c3726237cca6735b9#r1954824502
 2025-02-15 13:33:52 +01:00
Dirk WetterandGitHub 4b57f4c9f9 Merge pull request #2656 from dcooper16/ticketbleed 
Enhance ticketbleed testing
 2025-02-15 13:31:15 +01:00
Dirk WetterandGitHub 4b4260831e Merge pull request #2653 from testssl/address_addCA_issue 
Address CA file parsing problem (3.2)
 2025-02-07 14:18:51 +01:00
Dirk Wetter ebc43ddafe Add previously added line from 3.0 in change log 
for consistency reasons
 2025-02-07 12:40:06 +01:00
Dirk Wetter 5e1db5f0a1 Address CA file parsing problem (3.2) 
.... by forbidding spaces in supplied CA files/directories

Also now we're sanitizing the cmd line parameter better using `safe_echo()`

See also #2647 .
 2025-02-07 12:30:41 +01:00
Dirk WetterandGitHub 21a89e40e8 Merge pull request #2650 from testssl/drwetter-patch-1 
Update Readme.md
 2025-02-07 10:01:31 +01:00
Dirk WetterandGitHub 72d9168389 add that pentest2xlsx is python 2025-02-07 10:00:50 +01:00
Dirk WetterandGitHub d38e6ef6a7 Update Readme.md 2025-02-07 09:57:20 +01:00
Dirk WetterandGitHub 5b58771040 Merge pull request #2649 from testssl/dependabot/github_actions/docker/setup-qemu-action-3.4.0 
Bump docker/setup-qemu-action from 3.3.0 to 3.4.0
 2025-02-07 09:50:49 +01:00
Dirk WetterandGitHub 6e72c9b81d Merge pull request #2646 from testssl/fix_feature2098 
Feature: Detection STARTTLS throtteling via code 421/SMTP
 2025-01-31 12:26:44 +01:00
Dirk 4b928108ec Add trotteling feature 
* reorder points
* add sieve also
 2025-01-31 11:39:45 +01:00
Dirk e73a2a9d53 Feature: Detection STARTTLS throtteling via code 421/SMTP 
For this anotehr variable needed to be passed to starttls_full_read()
via starttls_smtp_dialog, where the variable is defined.

Handling of the connection problem will occur at the calling level, fd_socket(),
so that in the future this can be extended if another STARTTLS problem signals
that we're too fast.

Fixes #2098.
 2025-01-31 11:26:44 +01:00
Dirk WetterandGitHub abd0170fc4 Merge pull request #2645 from teunvink/3.2 
fix missing semicolon in docs
 2025-01-30 10:59:06 +01:00
Dirk WetterandGitHub 65c18bed99 Merge pull request #2644 from testssl/fix_2642 
Fix error when hostname w trailing dot supplied
 2025-01-29 22:51:35 +01:00
Dirk Wetter 61cf7fe0e7 Fix error when hostname w trailing dot supplied 2025-01-29 20:47:13 +01:00