Git/testssl.sh
1
0
Fork 0
mirror of https://github.com/drwetter/testssl.sh.git synced 2026-09-14 13:48:16 +02:00
Code Issues Packages Projects Releases Wiki Activity
296 Commits 16 Branches 39 Tags
9de6cc9108115b7e90466ed6858ff8f0bb6dff4a
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Dirk Wetter 9de6cc9108 Update Readme.md 2015-05-12 10:21:31 +02:00
Dirk 6938f16923 - WONTFIX remarks for #103 and #102 
- better warning for openssl < 1.0
 2015-05-11 16:58:57 +02:00
Dirk c1d6541d1a URL_PATH regression fixed 2015-05-11 10:47:26 +02:00
Dirk 8a039b8aa1 - two fixes from #40 reported by @salt-lick 2015-05-11 08:52:40 +02:00
Dirk 64efb4be94 - FIX: 30x with BigIP doesn't have a date, handled properly now 
- generic GET/HEAD is now always with URL_PATH
 2015-05-10 23:38:06 +02:00
Dirk f0c1548c37 - informative header extended 2015-05-10 20:54:43 +02:00
Dirk 26b4a53884 - NUMEROUS FreeBSD9/Darwin FIXES #40 
- http date
  - cipher list in preferences
- GET_REQ11 now closes the connection
- openssl_age comes afeter the banner so that help doesn't need to go thru this
- uname -s ==> SYSTEM
 2015-05-10 19:20:55 +02:00
Dirk 7e1ffa2fb5 - more robust wrt IIS6 (some stuff better with IIS7) 
- X-Powered-By is easy to remove (PHP, ASP.NET), thus labelled as yellow
- same X-AspNet-Version (version # itself is brown)
- better addressed address resolution failures ;-)
- bumped up version to 2.4rc1
 2015-05-06 18:48:51 +02:00
Dirk 9a3c4bc4b9 - FIX $87 (2), finally 
- feature: integrated TLS+HTTP time into server defaults
- NEW: option: -U/vulnerable
- moved explanation for BREACH into result
- FREAK and CCS are not labled experimental anymore
- unifying of get request headers
- readability of help
 2015-05-02 15:01:02 +02:00
Dirk Wetter 31e781d229 - partly FIX for #87 (removed SNI helps. Doesn't make sense anyway) 
- changed order of Secure Renegotiation/Secure Client-Initiated Renegotiation
- readability improvements in renego
 2015-05-01 12:18:43 +02:00
Dirk 254cb24a64 - fix additional \n in RC4 if no RC4 ciphers were detected 2015-04-28 08:04:09 +02:00
Dirk Wetter 48bab2d57b Update Readme.md 2015-04-24 16:52:08 +02:00
Dirk 63ca8c6520 - more thourough what has been done 2015-04-23 09:25:28 +02:00
Dirk Wetter 7cbb8150a4 Update Readme.md 2015-04-23 08:48:28 +02:00
Dirk 3c7620bd8d - RC4 has now 2 CVEs and cipher per default are displayed short 
- introducng a variable name LONG which for certain funcs shows broad output with hexc, cipher, KX, etc.
- FIX: regression not showing security headers
- introducing VULN_THRESHLD
 2015-04-22 18:24:39 +02:00
Dirk c4bf117393 - FIX #83 
- emphasize also OS names in HTTP headers
 2015-04-22 15:22:53 +02:00
Dirk a4f1873f63 - FIX for complete bailing out 2015-04-22 11:56:13 +02:00
Dirk b5ac31c20c - reordering code so that all attacks are together 
- RC4 is now really omitted in PFS test
- cleanup of some comments
 2015-04-22 10:33:44 +02:00
Dirk c4facbbecc typo 2015-04-21 08:14:36 +02:00
Dirk 709bb758fe - better compatibility with windows 2003 server 
- all long options are advertised now as with dashes and not underscore
- cosmetic stuff
 2015-04-20 10:05:01 +02:00
Dirk 46a611ac29 FIX for #82 2015-04-18 23:03:16 +02:00
Dirk Wetter 3e2ed654c2 Indicated freeze 2015-04-16 21:05:23 +02:00
Dirk 9b1657ee06 - BUGFIX: IIS server lead to false pisitive if SSLv3 was enabled 
(timeout was faster then socket resply)
- FIX: CORS header not labeled as green
- NEW: Now also STARTTLS works with all cmd line options and is absolutely doing the same stuff!
  (integrated starttls() into parse_hn_port() )
- option --mx needed to be changed because of starttls
- regression fix: exec for socket doesn't play nice with stderr redirect
  (probably bash bug)
- added some env options to cmd line as long args (--assuming-http,--ssl_native,
  --color, debug, --sneaky, --warnings)
- threw away getent as it doesn't work under Linux && not network && localhost
  (replaced by grep)
- SSL-POODLE is not labeled anymore experimental
- HB+CCS are called while checking STARTTLS but given a hint that its not yet supported
- added more env vars to debug output
- cleanups
 2015-04-16 20:36:17 +02:00
Dirk 519f0ad699 - FIX regression: more_flags execution was missing 
- FIX regression: capitalized/all lowercase headers weren't detected
- if socksend is blocked (IDS) output looks better and is reported as test didn't succeed
- no secure cookie or Httponly will be marked as brown
- tput color yellow is now brown
 2015-04-14 13:16:43 +02:00
Dirk e0dbef62e6 - more robust grep >=2.20, e.g Debian 8.0 (thx @stevenb18) 
- FIX: false positive for breach while testing google.com (referer header was hardcoded to google.com)
 2015-04-14 10:15:07 +02:00
Dirk 40baa7c163 - FIX (regression): -V 
- logic of some ENV variables changed (attention!)
- included some ENV as long options (not in the help yet)
- decentralized http check for breach
- if openssl is not executable it bails out better now
- help function now exits
 2015-04-13 22:55:40 +02:00
Dirk 07394d2d17 Merge branch 'master' of github.com:drwetter/testssl.sh 2015-04-10 15:16:20 +02:00
Dirk b8384eceff - underline CN, SAN and issuer deutschepost case (see sourceforge.net/p/ssllabs/mailman/message/33764851/) 2015-04-10 15:15:47 +02:00
Dirk Wetter 79ee5b377a Update Readme.md 2015-04-10 10:13:30 +02:00
Dirk Wetter b670c01f36 Update Readme.md 2015-04-09 22:24:57 +02:00
Dirk b0c68d4429 FIX: missing server preferences, NEW: each cipher server preferences per protocol! 2015-04-09 22:08:48 +02:00
Dirk 9945ef0e81 - 2015-04-09 21:45:22 +02:00
Dirk 5051eb3d5d - fixes to changes from Peter's better cmd line parsing 
- cosmetc improvements (vulneraibilities)
 2015-04-09 21:42:52 +02:00
Dirk Wetter cb98920733 Merge pull request #79 from PeterMosmans/refactoring 
Refactored major parts of code
 2015-04-09 21:38:29 +02:00
Dirk 44b31a1c54 FIX #80: show HTTP 401 2015-04-02 13:35:22 +02:00
Dirk 80f932ca30 NEW: added security headers 2015-04-02 13:04:57 +02:00
Dirk 9ea84ee6ec - got rid of "strings" 2015-04-02 12:19:24 +02:00
Dirk 348f651fc8 - updated binaries from Peter. Necessary because handshake under rare circumstances 
failed (routines:tls1_setup_key_block:cipher or hash unavailable:t1_enc.c:802.
  SLES 12 server, some ciphers under TLS 1.2
 2015-04-02 11:46:12 +02:00
Dirk 7b9c125046 protocol check via sockets now also for SSLv3 2015-03-31 10:34:30 +02:00
Dirk 5e9bb1c7e2 cleanups / bsd date in tls time 2015-03-30 23:09:19 +02:00
Dirk 74b6bd7241 rechi 2015-03-30 15:03:29 +02:00
Dirk 9bd1b44270 open fixes from Rechi (pull request $67) 2015-03-30 14:59:44 +02:00
Dirk Wetter 77fd58e556 Merge pull request #75 from feld/tr 
Using square brackets in tr results in trying to match/replace them
 2015-03-19 09:14:54 +01:00
Dirk Wetter c0e6777666 Merge pull request #76 from feld/printf 
Fix variable directly referenced in printf
 2015-03-19 09:14:32 +01:00
Dirk 7157d094bb Дилян 2015-03-17 22:14:05 +01:00
Dirk 485f0f8080 - FIX for 3des cipher report (thx Дилян) 2015-03-17 22:12:25 +01:00
Dirk 1de535cc25 - added two pairs of ciphers to server preference (thx Dilian) 2015-03-17 22:02:23 +01:00
Dirk 79396acf97 - working tls handshake with bash sockets (not yet in production, hint: see option "-q" in the bottom) 2015-03-17 18:11:18 +01:00
Dirk c4877799ec - check whether openssl is executable 
- spaces to tabs
- adding hint to "aha" in help
 2015-03-17 15:14:58 +01:00
Dirk 761e854610 - FIX for date --> applied to other BSD systems too 
- FIX for SNI output as it doensn';t make sense for non HTTP servives
- lines for RC4 and PFS shortenedA
- display all MX records to test before testing
- removed LOCERR, added CCS_MAX_WAITSOCK, HEARTBLEED_MAX_WAITSOCK
 2015-03-17 12:22:21 +01:00
Dirk c8090600b6 - some internal code internal cleanups 
- minor cosmetic output corrections
- preparation for bash sockets for SSLv3 to TLS 1.2
 2015-03-16 00:22:51 +01:00
Dirk 41c4ed94c1 further improvements through shellcheck 2015-03-15 16:59:29 +01:00
Dirk 639258cfe0 FIX #74 for sed BSD: doesn't like inline \n 
headline for BEAST was missing
 2015-03-15 16:10:14 +01:00
Dirk c2ece82d9b - FIX: regression for wc -l w/o cat (3x) 
- removal of unneccessary waitpid, inline
 2015-03-15 14:41:34 +01:00
Dirk bdd0602c1f - prework for checking hpkp fingerprints 2015-03-15 10:18:37 +01:00
Dirk 7d43dd7c8a - Shellcheck static analysis by Mark 2015-03-15 09:04:49 +01:00
Dirk Wetter 06268de428 Merge pull request #73 from feld/master 
Shellcheck static analysis
 2015-03-15 08:56:01 +01:00
Dirk d31b517b31 - @feld 2015-03-13 12:21:06 +01:00
Dirk dc05ff9b13 - FIX garbled output for servers with a TLS reply on SSLv2 socket call 2015-03-13 12:20:19 +01:00
Dirk Wetter 1ca03e3ed9 Merge pull request #72 from feld/feld 
Minor optimizations to reduce unnecessary forking
 2015-03-13 11:00:52 +01:00
Dirk 7348093a12 FIX for #71 (proper workaround for lastpipe in rc4, pfs, and cbc) 2015-03-09 08:07:45 +01:00
Dirk 8b67fa3889 - NEW: proper check for freak CVE-2015-0204 
- NEW: check for number of keys for hpkp
- cleanup hsts+hpkp
 2015-03-07 09:51:55 +01:00
Dirk 48f5d6db87 - MX record: the lower the # the higher the priority (thx, rechi) 2015-03-03 07:21:30 +01:00
Dirk 8288bbd375 - see #41 2015-03-02 14:44:02 +01:00
Dirk 2d6c087f84 - finalize mx records, FIX: #41 2015-03-02 14:42:28 +01:00
Dirk Wetter 21f3cbf009 Merge pull request #66 from Rechi/master 
Check MX Records (#41)
 2015-03-02 14:13:33 +01:00
Dirk 4e4e85fe96 - remark about rc4 rfc 2015-03-02 14:09:34 +01:00
Dirk Wetter c279fb90b7 Update Readme.md 2015-03-02 13:59:45 +01:00
Dirk 694d579110 - better detection for ssl poodle 
- change of shorticut from zero to letter o
 2015-02-27 21:21:39 +01:00
Dirk Wetter d7c2dedd06 Merge pull request #65 from schuetzm/fix-nrsaved 
Don't let error message slip through when no certs have been downloaded
 2015-02-24 18:28:09 +01:00
Dirk Wetter c8e3bce79a Merge pull request #64 from PeterMosmans/spellingfix 
FIX: minor spelling issue
 2015-02-24 10:03:32 +01:00
Dirk f193a0e5b0 - FIX #62 (CentOS 7/RHEL: engine failure), was not usable b4 2015-02-23 10:40:10 +01:00
Dirk affac236ca - FIXED: #47 ("double" linefeed if RFC mapping file is not present) 2015-02-22 23:05:40 +01:00
Dirk 4e863e4fa5 - NEW: tells how many certificates provides (and grabs them with DEBUG=1) 
- COLOR for no cipher order is red now
- "VULNERABLE" comes now always with "NOT ok"
 2015-02-21 11:47:12 +01:00
Dirk d16939ea8f - FIXED: #38, new openssl from Peter Mosmans makes the workaround unneccessary 2015-02-21 10:46:30 +01:00
Dirk 14385bf435 - to tell the difference between the sets of binaries 2015-02-21 10:39:27 +01:00
Dirk 31262a1011 - FIXED: #38, new openssl from peter mosmans makes the workaround unneccessary 2015-02-21 10:38:04 +01:00
Dirk Wetter 97337cb142 Update Readme.md 2015-02-15 14:10:11 +01:00
Dirk 966b75a893 - Fix #55 (302 detection for URL) 2015-02-15 14:00:13 +01:00
Dirk 5ea0b8c281 - Fix #46 (preload lists HPKP and HSTS) 
- word match for includeSubDomains (useful if one specified the keyword wrong)
 2015-02-15 13:37:44 +01:00
Dirk 388ffa8fe0 - FIX #60: mod_security CRS doesn't complain anymore 2015-02-15 13:14:11 +01:00
Dirk 07fbb8c8f0 - certificate sha2 fingerprint added (#59, @@kyhwana) 
- sha1 fp: removed colons as long serials after it look ugly (lf)
 2015-02-15 12:58:51 +01:00
Dirk 6d37c9a3c5 - workaround for issue #58, same in http_header 
- FIX: if a web site returned IMAP e.g. in HTML code it may have led to the assumption IMAP is the service ;-/
 2015-02-13 16:01:46 +01:00
Dirk e031ec83ed - FIX regression: CRIME check 
- FIX: port ended up sometimes as URL part
- also if it runs http a line is displayed as confirmation that HTTP was detected
 2015-02-12 13:40:53 +01:00
Dirk 8a94b05bc6 - new build with proper banner string 2015-02-12 11:12:49 +01:00
Dirk Wetter 8d06f03f0b Update Readme.md 2015-02-12 10:50:52 +01:00
Dirk Wetter 43fe25188a Update Readme.md 2015-02-12 09:45:26 +01:00
Dirk b7911371d1 - WORKAROUND for bug in PeterMosmans OPENSSL chacha/poly version: not testing EXPORT40/EXPORT then 2015-02-12 09:32:47 +01:00
Dirk 8e9b07e72d - NEW: check for Secure Client-Initiated Renegotiation 
- debugging #1: PS4 and debugme
- debugging statement tmpfile_handle where missing #2
 2015-02-11 09:43:04 +01:00
Dirk Wetter a2b4319571 Update Readme.md 2015-02-10 13:18:02 +01:00
Dirk 98f035f9e3 - sha2 like mozilla 2015-02-10 12:43:08 +01:00
Dirk 2a70c5ca01 Merge branch 'master' of github.com:drwetter/testssl.sh 2015-02-10 12:40:14 +01:00
Dirk Wetter cb64eacbb1 Update Readme.md 2015-02-10 12:39:54 +01:00
Dirk Wetter ad4d2308bd Update Readme.md 2015-02-10 12:39:20 +01:00
Dirk Wetter 4ee7abb863 Update Readme.md 2015-02-10 12:39:02 +01:00
Dirk 5683e1bf14 - vanilla as a workaround for bug #38 2015-02-10 12:37:03 +01:00
Dirk Wetter 0181d3b349 Update Readme.md 2015-02-10 12:34:35 +01:00
Dirk Wetter d35753414a Update Readme.md 2015-02-10 12:20:59 +01:00
Dirk Wetter 027c8c2867 Update Readme.md 2015-02-10 12:00:02 +01:00
Dirk Wetter 21819b7996 Update Readme.md 2015-02-10 11:59:47 +01:00