Git/testssl.sh
1
0
Fork 0
mirror of https://github.com/drwetter/testssl.sh.git synced 2026-09-14 13:48:16 +02:00
Code Issues Packages Projects Releases Wiki Activity
5,314 Commits 16 Branches 39 Tags
9c086b2e15ebf7f1dd40e8b1703f6738900a75f1
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Dirk WetterandGitHub 9c086b2e15 Merge pull request #3002 from testssl/dependabot/github_actions/docker/build-push-action-7 
Bump docker/build-push-action from 6 to 7
 2026-03-12 11:02:37 +01:00
Dirk WetterandGitHub 3142e73b99 Merge pull request #3001 from testssl/dependabot/github_actions/docker/setup-buildx-action-4 
Bump docker/setup-buildx-action from 3 to 4
 2026-03-12 11:02:13 +01:00
Dirk WetterandGitHub a24990ef90 Merge pull request #3000 from testssl/dependabot/github_actions/docker/metadata-action-6 
Bump docker/metadata-action from 5 to 6
 2026-03-12 11:01:45 +01:00
Dirk WetterandGitHub 63a07e38e1 Merge pull request #2999 from testssl/dependabot/github_actions/docker/setup-qemu-action-4 
Bump docker/setup-qemu-action from 3 to 4
 2026-03-12 11:01:01 +01:00
Dirk WetterandGitHub a7f16fd189 Merge pull request #2998 from testssl/dependabot/github_actions/docker/login-action-4 
Bump docker/login-action from 3 to 4
 2026-03-12 11:00:30 +01:00
Dirk WetterandGitHub 87ecc1c9f2 Merge pull request #2997 from testssl/drwetter-patch-1 
don't use 3.0 docker images anymore
 2026-02-19 10:53:34 +01:00
Dirk WetterandGitHub 81fb5f967f don't use 3.0 anymore 2026-02-19 10:52:31 +01:00
Dirk WetterandGitHub 552e10ce8a Merge pull request #2995 from testssl/drwetter-patch-1 
Amend IPv6 with host networking
 2026-02-18 10:32:48 +01:00
Dirk WetterandGitHub 8aca6f0665 Amend IPv6 with host networking 2026-02-18 10:31:24 +01:00
Dirk WetterandGitHub aef8616e5b Merge pull request #2992 from testssl/back2thedev 
Change banner back to 3.3dev
 2026-02-18 10:25:29 +01:00
Dirk WetterandGitHub 4086cb593e Merge pull request #2994 from testssl/drwetter-patch-1 
Docker + IPv6
 2026-02-18 10:01:48 +01:00
Dirk WetterandGitHub 6cc8c857a8 Docker + IPv6 2026-02-18 10:00:57 +01:00
Dirk 094c61caea Change banner back to 3.3dev 2026-02-13 14:25:58 +01:00
Dirk WetterandGitHub cdc892e323 Merge pull request #2991 from testssl/3.3snap1 
Add "dev" to the version banner to clarify
 2026-02-13 13:46:54 +01:00
Dirk c895a5c268 Add "dev" to the version banner to clarify 
And modify the banner accordingly depending on whether it's a
snapshot release or not.
 2026-02-13 11:18:13 +01:00
Dirk WetterandGitHub a9fc8a17c5 Merge pull request #2989 from testssl/3.3snap1 
Prepare for a snapshot release
 2026-02-13 08:36:20 +01:00
Dirk c600b2cb38 Prepare for a snapshot release 
- "3.3" still signals it's not oldstable
- "snapshot-YYMM" speaks for itself
 2026-02-12 23:15:07 +01:00
Dirk WetterandGitHub 18a1264223 Merge pull request #2985 from testssl/fix_2983_robot_timeout 
Finalize renaming MAX_WAITSOCK --> ROBOT_TIMEOUT
 2026-02-11 21:36:17 +01:00
Dirk ee316ef7ee Google has KEMs wjhich openssl doesn't show 2026-02-11 20:06:24 +01:00
Dirk 98d3c8399f Fix typo in ROBOT_TIMEOUT 
... which may led to false positives

Also in a number of tests the timeout was re-adjusted so that the robot check
performs ~25% faster -- on MacOS. On Linux it's about the same.
 2026-02-11 19:00:38 +01:00
Dirk 496373a60f Finalize renaming MAX_WAITSOCK --> ROBOT_TIMEOUT 
The commit 51a35b0344 changed variable names but there were leftovers. Also
before the tiemout values were reduced, so that the check may run faster. What was left were that some
timeout values were still too long. Thus MAX_WAITSOCK is now completely changed to ROBOT_TIMEOUT .
Also when the ROBOT check identified something as potentially vulnerable, the timeout value ist increased to
8 seconds which is less than in 3.2 . Tests however showed so far that there were no false positives or
negatives.

Moreover it changes the local variable robottimeout to robot_timeout.

This PR fixes #2983 for 3.3dev .
 2026-01-22 19:57:32 +01:00
Dirk WetterandGitHub 79db2763b6 Merge pull request #2982 from testssl/feature_2806 
Flag absence of extended master secret extension
 2026-01-15 15:19:45 +01:00
Dirk ca55c5b180 Exempt the debug statement "Extended master secret extension detected" 2026-01-15 11:20:01 +01:00
Dirk d78fae2dce Add extended_master_secret extension 2026-01-14 20:37:33 +01:00
Dirk 52ffa95696 Flag absence of extended master secret extension 
This PR fixes #2806 and implements a feature request. TLS >=1.2 MUST support
support the extended_master_secret extension to address an attack resulting
from TLS session parameters not being properly authenticated in a Triple
Handshake scanario (https://ieeexplore.ieee.org/document/6956559).

Only if the extension is missing there will be a medium severity level
finding. JSON output will be generated in any case.

Also in determine_tls_extensions() some documenation about tls extensions
to be send were added.
 2026-01-14 20:22:59 +01:00
Dirk WetterandGitHub 251d5ac02a Merge pull request #2981 from testssl/fix_2973 
Remove VULN_THRESHLD relic
 2026-01-13 20:05:44 +01:00
Dirk cf77cd2ad4 fix spelling 2026-01-13 17:33:33 +01:00
Dirk 3e10b3a9a2 Remove VULN_THRESHLD relic 
This fixes #2973.

There was a while back an extra headline when one or a defined other
number of vulnerabilities were checked. The extra headline was removed
n #2967 but some leftover code needed to be removed as well.

In the aforementioned previous PR it seems run_starttls_injection()
and run_rc4() were forgotten. This PR removes extra headlines in
those functions as well.
 2026-01-13 17:24:27 +01:00
Dirk WetterandGitHub 4e10bd24da Merge pull request #2979 from testssl/drwetter-patch-1 
general remarks, check boxes
 2026-01-13 10:36:30 +01:00
Dirk WetterandGitHub 62934191d3 minor tweaking 2026-01-13 10:35:50 +01:00
Dirk WetterandGitHub edbec494c6 Merge pull request #2980 from testssl/OPENSSL2_hint 
Suggest alternative $OPENSSL2 when $OPENSSL fails
 2026-01-13 10:30:31 +01:00
Dirk 45b27872c9 fix typo 2026-01-12 21:22:45 +01:00
Dirk d360b27b83 Suggest alternative $OPENSSL2 when $OPENSSL fails 
.. as an UI improvement for the user.

Implemented for Ticketbleed and during startup in determine_optimal_proto() .
For the latter it could be considered later to automagically pick $OPENSSL2 .
 2026-01-12 21:07:15 +01:00
Dirk WetterandGitHub 2ea57ec490 typos 2025-12-26 20:28:28 +01:00
Dirk WetterandGitHub c89a41e627 general remarks, check boxes 2025-12-26 20:26:26 +01:00
Dirk WetterandGitHub 6a5a69fcfd Merge pull request #2978 from testssl/drwetter-patch-1 
Polish
 2025-12-20 23:24:50 +01:00
Dirk WetterandGitHub f16e270e6a Polish 2025-12-20 23:24:15 +01:00
Dirk WetterandGitHub ee8055ef61 Merge pull request #2977 from testssl/drwetter-patch-1 
Add FAQ
 2025-12-20 23:19:59 +01:00
Dirk WetterandGitHub 1650b445ef Add FAQ 2025-12-20 23:19:22 +01:00
Dirk WetterandGitHub 4c27d8a8b9 Merge pull request #2975 from testssl/badges_patch 
Update badges
 2025-12-19 15:19:34 +01:00
Dirk WetterandGitHub 2274c6cd5b Merge pull request #2974 from testssl/robot_timeout_doc 
Add ROBOT_TIMEOUT to documentation
 2025-12-19 15:18:50 +01:00
Dirk bca823a0cc Update badges 
- sort them better
- add forks+stars
- remove gitter
 2025-12-19 15:17:07 +01:00
Dirk 3ac39032fa Add ROBOT_TIMEOUT to documentation 
Also
* remove VULN_THRESHLD from docs

Note: pandoc was a different version, so the roff output has different
encodings for different special chars.
 2025-12-19 15:07:40 +01:00
Dirk WetterandGitHub 61d0189f8f Merge pull request #2969 from testssl/mitigate_2083 
Mitigate inconsistent test results for ROBOT
 2025-12-19 13:59:48 +01:00
Dirk Wetter 6cd5b4364c Merge branch '3.3dev' into mitigate_2083 2025-12-15 13:13:50 +01:00
Dirk WetterandGitHub 28baa6be44 Merge pull request #2968 from testssl/fix_missing_vulnHeadline 
ROBOT is also a vulnerability
 2025-12-15 13:12:56 +01:00
Dirk Wetter 81f25a6674 Mitigate inconsistent test results for ROBOT 
As reported a longer while back in #2083 there were trailing bytes
when receiving a TLS alert by the ROBOT check.

This PR corrects and thus normalizes the length of the TLS alert message to the
correct value, supposed the length in the TLS alart is two bytes and it is an
TLS alert.

Also this PR now uses a separate variable for the timeout. In 2ce0110e the timeout
was changed by mistake as MAX_WAITSOCK was reduced from 10 to 5. For this check it
is still 5 which seemed fine (TBC). Using a separate global variable however may offer
some possibility for tuning the check when the latency to the target is high.
 2025-12-15 12:52:41 +01:00
Dirk Wetter 51a35b0344 ROBOT is also a vulnerability 
We missed somehow to add in the big while loop to add the fact that
ROBOT is a vulnerability which become apparent with #2967.

This PR adds that.
 2025-12-15 11:44:42 +01:00
Dirk WetterandGitHub 08398b3ac2 Merge pull request #2967 from testssl/address_2943 
Remove underlined headline for each vulnerability
 2025-12-15 11:07:17 +01:00
Dirk Wetter 26e90d44c3 Remove underlined headline for each vulnerability 
This PR removes this legacy feature. There's a single
headline for vulnerabilties instead.

Fixes #2943.
 2025-12-14 21:24:30 +01:00
Dirk WetterandGitHub 3430bd97d2 Merge pull request #2965 from testssl/fix_2944 
Add missing LF after pwnkeys DB check
 2025-12-14 21:03:51 +01:00
Dirk Wetter eeb8e7dbf1 Add missing LF after pwnkeys DB check 
This fixes #2940 .
 2025-12-14 17:43:44 +01:00
Dirk WetterandGitHub 651ddc1876 Merge pull request #2963 from dcooper16/fix2959 
Fix #2959
 2025-12-13 15:37:16 +01:00
Dirk WetterandGitHub 7a0b62e689 Merge pull request #2961 from testssl/fix_2960 
Label missing KEMs as LOW severity
 2025-12-09 12:43:05 +01:00
Dirk Wetter 03f43ecd68 Label missing KEMs as LOW severity 2025-12-09 10:15:50 +01:00
Dirk WetterandGitHub 1250d6f853 Merge pull request #2958 from testssl/fix_early_data_empty 
Fix error when early data empty
 2025-11-29 22:38:18 +01:00
Dirk ece7bce138 Merge branch '3.3dev' into fix_early_data_empty 2025-11-29 20:55:56 +01:00
Dirk WetterandGitHub 2b73544efc Merge pull request #2954 from testssl/address_2952 
Address 2952
 2025-11-29 20:53:43 +01:00
Dirk Wetter 8ed4b4218c this may fix it 2025-11-29 18:43:00 +01:00
Dirk Wetter d92769d15c trying again to make Mac work 2025-11-29 13:45:00 +01:00
Dirk 17896a44a5 move unlink 2025-11-28 17:23:50 +01:00
Dirk 4bc0a5ccba Change back to google.com, avoid 0-RTT for Mac 
... as we can't make it to get proper results unless
on the laptop
 2025-11-28 16:26:25 +01:00
Dirk Wetter d3c33867d7 Rather try cloudflare... 
instead of google.com. Maybe google's edge server to github has
different configuration and thus has not 0-RTT.

On my Mac it worked fine before.
 2025-11-28 13:28:58 +01:00
Dirk 2b06c97f19 Add 0-RTT, more in line with other files 
... and simplyfied
 2025-11-28 03:20:10 +01:00
Dirk Wetter d648a0851d Fix error when early data empty 
This PR fixes an error when early data was empty
which caused testssl.sh to exit instead of marking
that there was no file returned.

Also it changes HEAD to GET as the latter is probably
more often supported.

There needs to be a unit test for 0-RTT / early data!
 2025-11-28 01:46:16 +01:00
Dirk b1d79b6d72 change style to be in line w others 2025-11-28 01:21:19 +01:00
Dirk 3a0a6eaf88 re-add $ 2025-11-27 22:17:54 +01:00
Dirk 7823699982 json and html unit tests more seamless 
- html_file / json_file
- file name comes in command, not earlier
- Both a title
- avoid fixed string for file names over and over
 2025-11-27 20:38:12 +01:00
Dirk 964e8924a4 define file var before using it 2025-11-27 19:45:39 +01:00
Dirk Wetter a4b6d1fca0 spellcheck 2025-11-27 18:49:12 +01:00
Dirk Wetter f3ebf0e971 Add autoflush thingy for MAcOS 2025-11-27 18:46:19 +01:00
Dirk Wetter 853da2a9de term pattern seems better than the "colorized list" 2025-11-27 18:39:52 +01:00
Dirk Wetter 3591f70a17 reorder lines 2025-11-27 18:31:43 +01:00
Dirk Wetter 8103a0e24d Make this work undeer MacOS 
- URI is now example.com bc Akamai doesn't block too many checks
  (MacOS runner was delayed and often hiccuped here)
- failed to flush message --prevention
- term pattern seems better than the "colorized list"
 2025-11-27 18:24:15 +01:00
Dirk Wetter 7e97fef030 remove LFs and comment 2025-11-27 18:22:48 +01:00
Dirk Wetter fc499cb67f Akamai keeps connection open (opossum check problem) 2025-11-27 18:21:26 +01:00
Dirk Wetter 0ef742a17a Just add comments, reorder lines 2025-11-27 17:44:31 +01:00
Dirk Wetter 4582bd8d73 Merge branch '3.3dev' into address_2952 2025-11-27 16:37:16 +01:00
Dirk WetterandGitHub 86700dbd7a Merge pull request #2957 from testssl/flush 
Try to remove the "failed to flush stdout" messages
 2025-11-27 16:34:40 +01:00
Dirk Wetter de6e92826a Add stdout flush 2025-11-27 14:23:27 +01:00
Dirk Wetter 5111804b75 Try to remove the "failed to flush stdout" messages 2025-11-25 00:23:13 +01:00
Dirk Wetter e8098fc1d2 fix remainder from old os definition 2025-11-24 12:03:03 +01:00
Dirk WetterandGitHub dd696bb871 Merge pull request #2955 from testssl/shellcheck_path_improvement 
No shellcheck in ./t/
 2025-11-24 11:20:18 +01:00
Dirk WetterandGitHub 92e0195118 No shellcheck in ./t/ 2025-11-24 11:19:13 +01:00
Dirk Wetter d359e1108d proper definition of os variable 2025-11-24 11:07:16 +01:00
Dirk Wetter 7ba99cd1e9 For MacOS we rather use homebrew's OpenSSL 2025-11-24 11:04:59 +01:00
Dirk Wetter 7b2804df41 remove STARTTLS 2025-11-24 10:48:41 +01:00
Dirk WetterandGitHub 4ad81cea9b Merge pull request #2953 from testssl/dependabot/github_actions/actions/checkout-6 
Bump actions/checkout from 5 to 6
 2025-11-21 15:12:34 +01:00
Dirk WetterandGitHub 7423aa8add Merge pull request #2951 from testssl/fixAndImprove_opossum_check_2950 
Fix and improve Opossum check
 2025-11-21 15:11:07 +01:00
Dirk 76824b5762 Fix and improve Opossum 
Under some circumstances the opossum vulnerability check got stuck
because the cat commdn was waiting for reading from the descriptor.
In some case like #2950 this happened when the HTTP head command
was incorrectly send in the first place.

This PR makes sure that the HTTP head is correct and it replaces
cat by read in a loop so that the HTTP response is read without
being blocked.

Also for http_head_printf() the argumensats passed were cleaned up.
 2025-11-19 20:55:20 +01:00
Dirk WetterandGitHub 718c6fe4ed Merge pull request #2947 from 24icewolf42/fix-mtls-client-pem-check 
Add support for EC private key in mTLS check
 2025-11-17 11:19:09 +01:00
Dirk WetterandGitHub 1394cc8d7d Merge pull request #2949 from testssl/shellcheck_ignore_files 
Ignore files types for shellcheck
 2025-11-15 14:43:59 +01:00
Dirk Wetter fd97a75241 Add comments for paths_ignore 2025-11-15 14:05:08 +01:00
Dirk Wetter c07d17ea8f Fix indentation + comment wrt paths_ignore 2025-11-15 13:56:19 +01:00
Dirk Wetter 00476b751a Ignore files types for shellcheck 2025-11-15 13:39:09 +01:00
Dirk WetterandGitHub 12e4ebd203 Merge pull request #2948 from testssl/ratingdoc_update 
Update docs after raiting only switch
 2025-11-15 13:37:06 +01:00
Dirk Wetter c9a886c396 Update docs after riing only swicth 
see #2945
 2025-11-15 13:31:42 +01:00
Dirk WetterandGitHub ae48b680fa Merge pull request #2945 from magnuslarsen/3.3dev 
feat: --rating-only flag to only test checks required for rating
 2025-11-13 08:00:15 +01:00
Dirk WetterandGitHub 932c91f67c Merge pull request #2941 from testssl/dependabot/github_actions/actions/checkout-5 
Bump actions/checkout from 4 to 5
 2025-11-11 16:46:21 +01:00
Dirk WetterandGitHub 4ba3500b0b Merge pull request #2940 from testssl/shellcheck_cherrypicked_2428 
Shellcheck cherrypicked from PR #2428
 2025-11-10 14:37:35 +01:00