Git/testssl.sh
1
0
Fork 0
mirror of https://github.com/drwetter/testssl.sh.git synced 2026-09-14 13:48:16 +02:00
Code Issues Packages Projects Releases Wiki Activity
358 Commits 16 Branches 39 Tags
ac92ffb3c2bb64a9a31a5b411fa8a6eaa0d8e0db
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Dirk ac92ffb3c2 Merge branch 'master' of github.com:drwetter/testssl.sh 2015-06-15 12:13:45 +02:00
Dirk 4432faf497 "--ip" works now (see help) 
little cleanups
 2015-06-15 12:13:16 +02:00
Dirk Wetter 3ca2b4d8a1 Update Readme.md 2015-06-15 11:29:05 +02:00
Dirk 46c43ee53f Merge branch 'master' of github.com:drwetter/testssl.sh 2015-06-11 21:41:53 +02:00
Dirk a98b67013a FIX #116 
CRIME is lightred/litegreen as it is not that bad as ccs or heartbleed
 resorted some functions
 2015-06-11 21:41:25 +02:00
Dirk Wetter 7be69786b8 Update Readme.md 2015-06-11 19:32:14 +02:00
Dirk bdff6ba1bd - TLS_FALLBACK* was missing in the help #22 #118 2015-06-11 18:46:22 +02:00
Dirk f9e4526f70 - polish of #118 
- FIX #22
 2015-06-11 18:33:06 +02:00
Dirk Wetter c39b69a45f Merge pull request #118 from JonnyHightower/master 
Added a check for TLS_FALLBACK_SCSV
 2015-06-11 18:30:07 +02:00
Dirk 8acc17b4bc - ease of making openssl binary with make-openssl.sh 
- Hint where the Readme is
- removal of old binaries
 2015-06-10 08:15:28 +02:00
Dirk 0f5c4981cb - more or less desperate try to figure out the real installation path (and find the mapping file) 
- help extended (equal sign, logjam)
 2015-06-02 22:13:19 +02:00
Dirk Wetter 312b02ac63 Merge pull request #117 from teward/patch-1 
Update OpenSSL reqs - LOGJAM checks need 1.0.2+
 2015-06-02 18:09:19 +02:00
Dirk 4081b2eef4 - wrong arg for dirname ($1) 2015-06-02 15:59:17 +02:00
Dirk 06c3b06a7a - regression fix on mapping file 2015-06-02 15:53:46 +02:00
Dirk Wetter 32acfa97a5 Merge pull request #115 from PeterMosmans/space 
Minor textual fix (added space)
 2015-06-02 09:26:25 +02:00
Dirk cac985967f - first prototype for using = in cmdline, see #108. Tests needed 
- beautified big case loop
 2015-06-01 12:01:38 +02:00
Dirk 452fd6762a - local dns matches don't need lookup anymore over net --> saves timeouts+time 
- further banner tuning + funtion mybanner, 2 addtl global vars for debugging
- cosmetic improvements
 2015-05-31 14:40:12 +02:00
Dirk 77ad7c9252 - the outsticking part was kind of not handy, see #113, remove commit message 2015-05-30 11:36:47 +02:00
Dirk Wetter 353b58c0c0 Merge pull request #113 from PeterMosmans/showversion 
FIX: Show version when specified on command line
 2015-05-30 11:16:31 +02:00
Dirk Wetter d066e0868a Merge pull request #112 from AntonioMeireles/cosmetics_1 
trim all whitespace at EOL, plus spelling typos fixes.
 2015-05-29 22:42:51 +02:00
Dirk 9b2b897a43 - make date even more beautiful, see #110 
- fix RUN_DIR
 2015-05-29 14:12:22 +02:00
Dirk Wetter df3b9019a1 Update Readme.md 2015-05-29 13:37:37 +02:00
Dirk Wetter e14453b607 Merge pull request #110 from AntonioMeireles/master 
simplify life for OSX users running gnu's coreutils...
 2015-05-29 11:01:47 +02:00
Dirk 4e18c35271 Merge branch 'master' of github.com:drwetter/testssl.sh 2015-05-29 10:36:47 +02:00
Dirk 41ee37f0dc - per default we do a allciphers run in the end 
- option long changed to wide
- PFS now is per default not wide
- PFS comes after standard cipher lists
- debug output improved (in terms of privacy and additional info)
 2015-05-29 10:36:14 +02:00
Dirk b48ac9874e - early check to make sure people really use bash, see #109 2015-05-29 10:10:53 +02:00
Dirk 2ac34c1424 - early check to make sure people really use bash, see #109 2015-05-29 10:08:17 +02:00
Dirk Wetter 8b10dc9638 - code improvements rc4, beast, logjam, freak 2015-05-27 23:31:25 +02:00
Dirk Wetter f9605c4f35 - BEAST now also works in wide mode 
- renamed --long in --wide
- added --show-each to help
- inserted help
 2015-05-27 17:04:35 +02:00
Dirk Wetter a76ca52c4c - first candidate for logjam (missing the precomuted primes though) 
- 1024 DH is now brown instead of red, 768 will be red, 512 bold red
- dumped calls to ok()
- further cosmetic stuff
 2015-05-27 14:28:18 +02:00
Dirk f261884499 Merge branch 'master' of github.com:drwetter/testssl.sh 
Conflicts:
	testssl.sh
 2015-05-27 11:24:47 +02:00
Dirk ed38a365ae - fix regression on missing rfc cipher names 
- cosmetic stuff
 2015-05-27 11:19:30 +02:00
Dirk Wetter efffe9867b - FIX: cipher mapping 
- adjust trailing spaces missing b4
 2015-05-26 19:26:21 +02:00
Dirk Wetter c7a76d9b86 - typo/ c&p error with dh func 
- fixed uninitialised var
 2015-05-26 15:59:27 +02:00
Dirk d58f39d008 - logjam 2015-05-26 12:57:15 +02:00
Dirk 8ab0aef84b Merge branch 'master' of github.com:drwetter/testssl.sh 2015-05-26 12:56:17 +02:00
Dirk 060178071d - for pfs. allciphers and cipher_per_proto we WARN now because of weak DH param (if openssl supports it) 
FIX #106, $85
- logjam not yet named *#105, #107) but addressed
- --openssl switch
- reorder find_openssl_binary / mybanner
- proper identation of help
 2015-05-26 12:51:10 +02:00
Dirk Wetter 9b13160953 Update Readme.md 2015-05-25 21:41:45 +02:00
Dirk 3c161f9ce4 - blanks in headlines added 2015-05-25 21:22:21 +02:00
Dirk 9c7d385098 - omit 1xblank in almost all colored output (and adjust the functions using it) 
- little bit more robust for strange keysize and dh bits
- added ecdsa-with-SHA256 to Signature Algorithm
- FIX: no TLS1+SSL3 resulted in no output for BEAST
 2015-05-25 21:14:59 +02:00
Dirk e58b53eeae - dh key lenghth in negotiated cipher at first, see $85, #105, #106 
- got rid of ok function calls in protocols
- detection of apache banner win32/win64
 2015-05-25 15:10:09 +02:00
Dirk a7a19428d6 - FIX for #104: check for hpkp pin match failed if \" was present 2015-05-18 23:10:34 +02:00
Dirk 0c4a36121e - NEW / FIX #104: check for hpkp pin match 2015-05-18 21:51:45 +02:00
Dirk Wetter bf7b867d86 Update Readme.md 2015-05-17 22:56:38 +02:00
Dirk 7cc15e5d4d - 2.4 2015-05-17 22:43:53 +02:00
Dirk 43732ae53d Merge branch 'master' of github.com:drwetter/testssl.sh 2015-05-17 22:42:53 +02:00
Dirk 4e7bbb20a0 - 2.4 2015-05-17 22:41:58 +02:00
Dirk 1c509bf845 2015-05-17 22:34:50 +02:00
Dirk 2919a7c40e - 2.4! 
- FIX #92
- FIX for TLS time (difftime was too small for local clock skew)
- warning for freebsd/macosx w/o ports need now a "yes"
- TLS 1.0 not offered is not bold anymore
- output weirdness fixed for cipher order in spdy
 2015-05-17 22:30:49 +02:00
Dirk 6e74b3bd5c - FIX of output whene there's no CBC cipher in BEAST 
- FIX: 2 occurrances of OPENSSL calls had a hostname instead of an IP address
- FIX: starttls protocol correctly displayed
- NEW added duplicate detection for header flags
- NEW: added four GOST cipher to standard socket handshake
- recommends if openssl 1.0.2 is used and results were strange and IIS6 --> run wqith openssl 1.0.1
- declared some global vars as readonly
 2015-05-15 21:32:11 +02:00
Dirk Wetter 7741d99cc8 Update Readme.md 2015-05-12 13:42:42 +02:00
Dirk 7614ac6f87 Merge branch 'master' of github.com:drwetter/testssl.sh 2015-05-12 13:38:20 +02:00
Dirk 16d2b33459 - Workarounds for IIS6 #99 : some places where openssl 1.0.2 cannot connect (as opposed 
to =< 1.0.1) finding the right protocol before
- hints for IIS6+openssl 1.0.2 non-conformity #99
- version bumped up to 2.4rc2
- better formatting for BSD in cipher order
- FIX: 2x bug for cipher order + sslv2
- preambel revisited
 2015-05-12 13:37:39 +02:00
Dirk Wetter a7d7158c4b Update Readme.md 2015-05-12 10:21:31 +02:00
Dirk 3a64bd1005 - WONTFIX remarks for #103 and #102 
- better warning for openssl < 1.0
 2015-05-11 16:58:57 +02:00
Dirk 35d8469f67 URL_PATH regression fixed 2015-05-11 10:47:26 +02:00
Dirk 08fe890d5f - two fixes from #40 reported by @salt-lick 2015-05-11 08:52:40 +02:00
Dirk 19fc021587 - FIX: 30x with BigIP doesn't have a date, handled properly now 
- generic GET/HEAD is now always with URL_PATH
 2015-05-10 23:38:06 +02:00
Dirk 0050df5529 - informative header extended 2015-05-10 20:54:43 +02:00
Dirk 2f79ba52fc - NUMEROUS FreeBSD9/Darwin FIXES #40 
- http date
  - cipher list in preferences
- GET_REQ11 now closes the connection
- openssl_age comes afeter the banner so that help doesn't need to go thru this
- uname -s ==> SYSTEM
 2015-05-10 19:20:55 +02:00
Dirk 0aa8ac7e76 - more robust wrt IIS6 (some stuff better with IIS7) 
- X-Powered-By is easy to remove (PHP, ASP.NET), thus labelled as yellow
- same X-AspNet-Version (version # itself is brown)
- better addressed address resolution failures ;-)
- bumped up version to 2.4rc1
 2015-05-06 18:48:51 +02:00
Dirk f3f3967bd1 - FIX $87 (2), finally 
- feature: integrated TLS+HTTP time into server defaults
- NEW: option: -U/vulnerable
- moved explanation for BREACH into result
- FREAK and CCS are not labled experimental anymore
- unifying of get request headers
- readability of help
 2015-05-02 15:01:02 +02:00
Dirk Wetter 2aa82e5164 - partly FIX for #87 (removed SNI helps. Doesn't make sense anyway) 
- changed order of Secure Renegotiation/Secure Client-Initiated Renegotiation
- readability improvements in renego
 2015-05-01 12:18:43 +02:00
Dirk d766a0b459 - fix additional \n in RC4 if no RC4 ciphers were detected 2015-04-28 08:04:09 +02:00
Dirk Wetter ae1abda571 Update Readme.md 2015-04-24 16:52:08 +02:00
Dirk 150fb671bb - more thourough what has been done 2015-04-23 09:25:28 +02:00
Dirk Wetter b492031b95 Update Readme.md 2015-04-23 08:48:28 +02:00
Dirk 1ea7a0947f - RC4 has now 2 CVEs and cipher per default are displayed short 
- introducng a variable name LONG which for certain funcs shows broad output with hexc, cipher, KX, etc.
- FIX: regression not showing security headers
- introducing VULN_THRESHLD
 2015-04-22 18:24:39 +02:00
Dirk 3891f5b13b - FIX #83 
- emphasize also OS names in HTTP headers
 2015-04-22 15:22:53 +02:00
Dirk 06bd8b2517 - FIX for complete bailing out 2015-04-22 11:56:13 +02:00
Dirk bafce6edce - reordering code so that all attacks are together 
- RC4 is now really omitted in PFS test
- cleanup of some comments
 2015-04-22 10:33:44 +02:00
Dirk c751e9f459 typo 2015-04-21 08:14:36 +02:00
Dirk 5bec0a16c9 - better compatibility with windows 2003 server 
- all long options are advertised now as with dashes and not underscore
- cosmetic stuff
 2015-04-20 10:05:01 +02:00
Dirk 7b6dba6369 FIX for #82 2015-04-18 23:03:16 +02:00
Dirk Wetter 3f0f489f50 Indicated freeze 2015-04-16 21:05:23 +02:00
Dirk 5625ee536e - BUGFIX: IIS server lead to false pisitive if SSLv3 was enabled 
(timeout was faster then socket resply)
- FIX: CORS header not labeled as green
- NEW: Now also STARTTLS works with all cmd line options and is absolutely doing the same stuff!
  (integrated starttls() into parse_hn_port() )
- option --mx needed to be changed because of starttls
- regression fix: exec for socket doesn't play nice with stderr redirect
  (probably bash bug)
- added some env options to cmd line as long args (--assuming-http,--ssl_native,
  --color, debug, --sneaky, --warnings)
- threw away getent as it doesn't work under Linux && not network && localhost
  (replaced by grep)
- SSL-POODLE is not labeled anymore experimental
- HB+CCS are called while checking STARTTLS but given a hint that its not yet supported
- added more env vars to debug output
- cleanups
 2015-04-16 20:36:17 +02:00
Dirk f682c5ceea - FIX regression: more_flags execution was missing 
- FIX regression: capitalized/all lowercase headers weren't detected
- if socksend is blocked (IDS) output looks better and is reported as test didn't succeed
- no secure cookie or Httponly will be marked as brown
- tput color yellow is now brown
 2015-04-14 13:16:43 +02:00
Dirk 9d5168dbb5 - more robust grep >=2.20, e.g Debian 8.0 (thx @stevenb18) 
- FIX: false positive for breach while testing google.com (referer header was hardcoded to google.com)
 2015-04-14 10:15:07 +02:00
Dirk 683e9dccab - FIX (regression): -V 
- logic of some ENV variables changed (attention!)
- included some ENV as long options (not in the help yet)
- decentralized http check for breach
- if openssl is not executable it bails out better now
- help function now exits
 2015-04-13 22:55:40 +02:00
Dirk 1043c40a60 Merge branch 'master' of github.com:drwetter/testssl.sh 2015-04-10 15:16:20 +02:00
Dirk a12d39769f - underline CN, SAN and issuer deutschepost case (see sourceforge.net/p/ssllabs/mailman/message/33764851/) 2015-04-10 15:15:47 +02:00
Dirk Wetter bfcd684e19 Update Readme.md 2015-04-10 10:13:30 +02:00
Dirk Wetter 9ebf112858 Update Readme.md 2015-04-09 22:24:57 +02:00
Dirk 53e0955dfb FIX: missing server preferences, NEW: each cipher server preferences per protocol! 2015-04-09 22:08:48 +02:00
Dirk 7f984ea83f - 2015-04-09 21:45:22 +02:00
Dirk a98161acc9 - fixes to changes from Peter's better cmd line parsing 
- cosmetc improvements (vulneraibilities)
 2015-04-09 21:42:52 +02:00
Dirk Wetter eb73ffc053 Merge pull request #79 from PeterMosmans/refactoring 
Refactored major parts of code
 2015-04-09 21:38:29 +02:00
Dirk 84aca9d9a3 FIX #80: show HTTP 401 2015-04-02 13:35:22 +02:00
Dirk 2cc56c4d1f NEW: added security headers 2015-04-02 13:04:57 +02:00
Dirk 8da96f78f2 - got rid of "strings" 2015-04-02 12:19:24 +02:00
Dirk 4bbd19ba03 - updated binaries from Peter. Necessary because handshake under rare circumstances 
failed (routines:tls1_setup_key_block:cipher or hash unavailable:t1_enc.c:802.
  SLES 12 server, some ciphers under TLS 1.2
 2015-04-02 11:46:12 +02:00
Dirk 940f51e74b protocol check via sockets now also for SSLv3 2015-03-31 10:34:30 +02:00
Dirk 9ed58b6202 cleanups / bsd date in tls time 2015-03-30 23:09:19 +02:00
Dirk 6c30386278 rechi 2015-03-30 15:03:29 +02:00
Dirk d9ae35fc7e open fixes from Rechi (pull request $67) 2015-03-30 14:59:44 +02:00
Dirk Wetter 7f4fc5902e Merge pull request #75 from feld/tr 
Using square brackets in tr results in trying to match/replace them
 2015-03-19 09:14:54 +01:00
Dirk Wetter f4c9f692d2 Merge pull request #76 from feld/printf 
Fix variable directly referenced in printf
 2015-03-19 09:14:32 +01:00
Dirk 0d3b7f343f Дилян 2015-03-17 22:14:05 +01:00
Dirk 2d0bfca343 - FIX for 3des cipher report (thx Дилян) 2015-03-17 22:12:25 +01:00
Dirk ca6ca5d47e - added two pairs of ciphers to server preference (thx Dilian) 2015-03-17 22:02:23 +01:00