Git/testssl.sh
1
0
Fork 0
mirror of https://github.com/drwetter/testssl.sh.git synced 2026-09-14 13:48:16 +02:00
Code Issues Packages Projects Releases Wiki Activity
3,462 Commits 16 Branches 39 Tags
c3d2cf75b41f14dad9f22aa33f9386dc4523b028
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Dirk WetterandGitHub c3d2cf75b4 Merge pull request #2003 from drwetter/drwetter-patch-1 
Fix typo / spelling error
 2021-10-02 22:32:44 +02:00
Dirk WetterandGitHub 9f8ed56534 Fix typo / spelling error 2021-10-02 22:31:14 +02:00
Dirk WetterandGitHub c1210e98a5 Merge pull request #1948 from drwetter/bump_version_3.0.6 
Bump version to 3.0.6
 2021-10-02 22:21:53 +02:00
Dirk WetterandGitHub 1732e9c919 Merge branch '3.0' into bump_version_3.0.6 2021-10-02 22:21:36 +02:00
Dirk WetterandGitHub b68147150a Merge pull request #2000 from mig5/fix-letsencrypt-remove-dst-root-x3-ca-cert-3.0-fixed 
Remove the expired DST Root CA X3 cert from all trust stores, and ensure Mozilla's is up to date (fixes ISRG X1 alternate path) - 3.0 branch
 2021-10-02 08:37:03 +02:00
Dirk WetterandGitHub 6c874cccee Merge pull request #1989 from drwetter/fix_1982-3.0__kali.cnf 
Fix #1982: Newer openssl.cnf break openssl detection (3.0)
 2021-09-15 12:41:56 +02:00
Dirk Wetter 8a53039de6 Fix #1982: Newer openssl.cnf break openssl detection (3.0) 
Newer configuration files from openssl may include statements
which aren't compatible with our supplied old openssl version.
This commit adds an autodetection of such a file and uses a
openssl.cnf provided by this project then.

The openssl.cnf is from a Debian Jessie package.

See also #1987
 2021-09-15 11:25:10 +02:00
Dirk WetterandGitHub 24ba9e6efa Merge pull request #1986 from DimitriPapadopoulos/3.0 
Typos found by codespell
 2021-09-14 14:49:37 +02:00
Dirk WetterandGitHub 19760b2775 Merge pull request #1980 from drwetter/fix_1978_3.0 
Fix minor inconsistency in description of cipher categories (3.0)
 2021-09-10 08:10:00 +02:00
Dirk a239ac7a6a Fix GHA (starttls nntp) 
using another IP
 2021-09-09 23:21:08 +02:00
Dirk 7be262f287 Fix minor inconsistency in description of cipher categories 
A longer while back the section ~ "Testing standard ciphers" was
renamed to "Testing cipher categories". However the internal help
didn't reflect that.

This fixes that, including an addtion to the documentation.

Note: the help still lists "-s --std, --standard" as a cmd line
switch.
 2021-09-09 21:50:03 +02:00
Dirk WetterandGitHub 99be55650a Merge pull request #1977 from ap-wtioit/3.0-fix_dig_r_check 
Fix dig -r check to only run if dig is available
 2021-09-06 10:30:47 +02:00
Dirk WetterandGitHub 516cd43dd3 Merge pull request #1973 from drwetter/fix_dig-r_3.0 
Fix cases where dig -r wasn't working (3.0)
 2021-09-01 19:33:43 +02:00
Dirk 80cbdf2748 Fix cases where dig -r wasn't working (3.0) 
Similar to #1972.

* the ignore ~/.digrc option from dig is now parsed from the builtin help
* there was a potential DNS call which is now avoided
* the +noidnout check is now parsed from the builtin help
* the OPENSSL_CONF="" in check_resolver_bins() was moved a few lines higher to avoid other errors in the terminal
* redo check for noidnout by also using the help function of dig

See also #1949
 2021-09-01 18:51:03 +02:00
Dirk WetterandGitHub 30a2f47e3d Merge pull request #1971 from dcooper16/fix_1961_3.0 
Fix #1961 in 3.0 branch
 2021-08-30 19:56:34 +02:00
Dirk WetterandGitHub 8d1e964788 Merge pull request #1969 from jauderho/3.0 
Add GH Action to build Docker images (3.0 branch)
 2021-08-27 09:32:33 +02:00
Dirk WetterandGitHub ea3f089b79 Merge pull request #1967 from jauderho/3.0_gha_build_status 
Update Readme.md
 2021-08-09 12:50:58 +02:00
Dirk WetterandGitHub 8b5f25a113 Merge pull request #1959 from dcooper16/use_all+_3.0 
Use all+ in calls to tls_sockets() in 3.0
 2021-08-07 16:07:22 +02:00
Dirk WetterandGitHub 578d173319 Merge pull request #1957 from drwetter/fix_1956 
Redirect debugme() outputs to stderr
 2021-08-07 13:55:31 +02:00
Dirk Wetter 65d6c27551 Redirect debugme() outputs to stderr 
... to address #1956 and other places.
 2021-08-04 19:33:01 +02:00
Dirk WetterandGitHub 91523be194 Merge pull request #1949 from drwetter/digrc_3.0 
Ignore $HOME/.digrc (3.0)
 2021-08-01 20:59:58 +02:00
Dirk Wetter 556208815a Merge remote-tracking branch 'origin/3.0' into digrc_3.0 2021-08-01 20:20:24 +02:00
Dirk WetterandGitHub a52b3b847d Merge pull request #1954 from drwetter/legacy_stuff 
Legacy removals + housekeeping
 2021-08-01 20:18:39 +02:00
Dirk Wetter 16c18789cd Legacy removals + housekeeping 
* remove relics (CVS)
* add diff to HTML CI run
 2021-08-01 18:25:13 +02:00
Dirk WetterandGitHub 2f398d3cd0 Merge pull request #1951 from drwetter/fix_1717_3.0 
Look-ahead trick for -U --ids-friendly (3.0)
 2021-08-01 17:46:58 +02:00
Dirk e293b7d839 Look-ahead trick for -U --ids-friendly 
If the order of the cmdline is '-U --ids-friendly' then we need to make sure we catch --ids-friendly. Normally we do not,
 see #1717. The following statement makes sure. In the do-while + case-esac loop  the check for --ids-friendly will be
executed again, but it does not hurt
 2021-07-31 18:47:00 +02:00
Dirk WetterandGitHub 0d6ca5c1b8 Merge pull request #1947 from drwetter/noitalics4screen_3.0 
Disable ANSI codes for italic when TERM == screen
 2021-07-31 15:26:26 +02:00
Dirk ac2b43170b Move dig down the row of DNS resolvers 
... because there's a higher possibility for the stable branch
that people use $HOME/.digrc
 2021-07-31 15:22:05 +02:00
Dirk 8d6609f1b9 Ignore $HOME/.digrc 
Newer dig versions have an option to ignore $HOME/.digrc, older
don't.

This commit adds a patch checking for the availability of
such an option and uses it by default.

If doesn't exist then still dig is used and can still lead to
wrong output. Unfortunately Debian-based distros are not very
good at this. Debian 10, Ubuntu 18.04 still use dig 9.11, whereas
Opensuse 15.2 has 9.16.

Debian 11 and Ubuntu 20.04 use that too.

Thus to be considered for the stable 3.0-branch: move
dig in the resolver functions a couple of lines down.
 2021-07-31 14:37:36 +02:00
Dirk a67a0200c2 Bump version 3.0.6 
There might be 1-2 PRs before 3.0.6 is being released.
 2021-07-31 14:12:15 +02:00
Dirk 13303753ff Disable ANSI codes for italic when TERM == screen 
... otherwise it is being printed in reverse, see #1928.
Same as #1946 but for the 3.0 branch.
 2021-07-31 13:22:47 +02:00
Dirk WetterandGitHub 5d4945819a Merge pull request #1944 from drwetter/docker_3.0 
Docker updates
 2021-07-30 17:36:20 +02:00
Dirk Wetter 4e8dd46815 Update description 
* tar.gz is now from testssl.sh
    * git clone refers to 3.0 instead of 3.1dev
 2021-07-30 17:34:56 +02:00
Dirk Wetter 6ffbf1bfa4 Update description 
* tar.gz is now from testssl.sh
* git clone refers to 3.0 instead of 3.1dev
 2021-07-30 17:33:08 +02:00
Dirk Wetter 5df1a2e7b9 Upgrade to alpine 3.12 
... as 3.11 is in a couple of months EOL .

I do not expect difficulties as we run 3.12 already in 3.1dev.
 2021-07-30 17:23:51 +02:00
Dirk WetterandGitHub e7713f8012 Merge pull request #1942 from drwetter/nmap_portdetection_1931_3.0 
Improved SSL/TLS portdetection in nmap greppable files (3.0)
 2021-07-30 15:51:23 +02:00
Dirk Wetter 5ae17681f6 Improved SSL/TLS portdetection in nmap greppable files (3.0) 
As mentioned in #1931 the port detection for nmap greppable files
leaves space for improvements.

Ths PR adds a pattern detection of ssl and https in the forth or fifth
parameter of an open port, so those ports will be added to a scan when
a nmap greppable output file is supplied as input to testssl.sh .

Also it does minor code adjustments to utils/gmap2testssl.sh .

Same as #1938, only for 3.0.
 2021-07-30 14:47:17 +02:00
Dirk WetterandGitHub f4800f8e5e Merge pull request #1937 from drwetter/fix_1935_3.0 
Fix problem when nmap file has .txt extension (3.0)
 2021-07-25 17:17:39 +02:00
Dirk 29bd7591f9 Supply new converter which matches on ssl and https 
... see #1936.

It is ~ copied from testssl.sh. It adds a detection for the
strings ssl and https. If those run at non-standard ports but nmap
detected it, it'll show up in the output file.
 2021-07-25 16:56:02 +02:00
Dirk 3544014fe3 Fix problem when nmap file has .txt extension (3.0) 
This addresses a bug filed in #1935 in 3.1dev when the supplied file
has a .txt extension. In this scenario the input file was nulled
as from the input file in nmap format an internal input file was
generated which has a .txt extension, in the same directory.
The idea was to persist the file for the user.

Now, this internal input file is ephemeral and only written to $TEMPDIR.
 2021-07-25 16:40:16 +02:00
Dirk WetterandGitHub ca558a9c08 Merge pull request #1922 from drwetter/gha_denylist_3.0 
Github actions modifications (3.0)
 2021-06-19 15:21:04 +02:00
Dirk 6fd4c466e4 Github actions modifications (3.0) 
Same as #1921, only for the stable branch

* define deny list of files when modified not to run GHA
* specitfy OS to be ubuntu-20.04 (is there a debian at all?)
* only use perl 5.26

See #1920
 2021-06-19 12:32:06 +02:00
Dirk WetterandGitHub 526bccaa34 Merge pull request #1918 from drwetter/travis2gha_3.0 
Migrate from travis-ci.org to github actions
 2021-06-18 09:56:57 +02:00
Dirk Wetter 7b9a6e334d Migrate from travis-ci.,org to github actions 
Kudos to Mikel, see PR #1909
 2021-06-18 08:39:00 +02:00
Dirk WetterandGitHub f7b29cac99 Merge pull request #1916 from drwetter/fix_1915_3.0 
Fix indentation and redundant message (BREACH) when client certificate required
 2021-06-17 09:29:19 +02:00
Dirk Wetter 19feed169e Fix indentation and redundant message (BREACH) when client certificate required 
... see #1915
 2021-06-17 09:23:34 +02:00
Dirk WetterandGitHub 96e8f67999 Merge pull request #1906 from drwetter/tz_fix+3.0 
Display time as suggested in utc (3.0)
 2021-06-03 20:23:20 +02:00
Dirk Wetter f6a9044315 Display time as suggested in utc (3.0) 
This fixes #1895
 2021-06-03 19:29:26 +02:00
Dirk WetterandGitHub c0d9427988 Merge pull request #1889 from dcooper16/send_to_stderr_30 
Print errors to stderr
 2021-05-15 12:22:43 +02:00
Dirk WetterandGitHub 931d0095d6 Merge pull request #1887 from ghen2/3.0-uname 
`hostname` is not defined by POSIX, use portable `uname -n` instead.
 2021-05-13 16:11:11 +02:00
Dirk WetterandGitHub 6829996197 Merge pull request #1886 from drwetter/3.0.5 
Bump version
 2021-05-10 13:50:07 +02:00
Dirk Wetter f5fde2a93b Bump version 2021-05-10 12:16:12 +02:00
Dirk WetterandGitHub 4976da43b0 Merge pull request #1883 from drwetter/epoch_180hsts_1879.branch_3.0 
Fix "off by one" error in HSTS
 2021-05-10 11:18:53 +02:00
Dirk WetterandGitHub 5758c397da Merge pull request #1885 from definity/3.0 
fixed minor bug with json output for TLS1.1
 2021-05-09 20:37:07 +02:00
Dirk Wetter 68cbdf8dc8 Fix "off by one" error in HSTS 
There was by mistake a 179 days threshold and also the error message
was wrong when HSTS was exactly set to 179 days, see #1879.

This commit sets it to 180 days and corrects the error messages on
screen.
 2021-05-08 14:55:30 +02:00
Dirk WetterandGitHub 835abd6acb Merge pull request #1870 from dcooper16/fix_ossl30 
Improve compatibility with OpenSSL 3.0
 2021-04-09 10:44:12 +02:00
Dirk WetterandGitHub 52ed92ca87 Merge pull request #1866 from drwetter/fix1860_svSE_etc_charset_3.0 
Ensure certain regex patterns work as expected and aren't localized (3.0)
 2021-04-05 14:29:22 +02:00
Dirk c461702112 Ensure certain regex patterns work as expected and aren't localized (3.0) 
Same as #1865.

This PR is trying to address an issue where probably newer bash versions treat
regexes differently in other locales. W is with a swedish locale just a variant
of V (#1860) see also e.g.

https://collation-charts.org/opensolaris/opensolaris.2008.05.sv_SE.UTF-8.html
https://www.sqlservercentral.com/forums/topic/order-by-name-not-works#post-1644177
 2021-04-05 11:38:17 +02:00
Dirk WetterandGitHub 7723a309b5 Merge pull request #1858 from jschauma/3.0 
add codepoints for RFC7905, ChaCha20-Poly1305
 2021-03-25 21:34:04 +01:00
Dirk WetterandGitHub acc9a82a07 Merge pull request #1848 from elfranne/ianaopenssl3.0 
IANA <-> Openssl mapping issue for 3.0
 2021-02-25 17:17:39 +01:00
Dirk WetterandGitHub bf966a9b2f Merge pull request #1831 from drwetter/fix_heartbleed_json.1828_3.0 
Fix file output formatting for heartbleed (3.0)
 2021-01-20 10:11:51 +01:00
Dirk a1777cdd0e Fix file output formatting for heartbleed 
Quotes were wrong for different results, which lead to some confusion
for finding, cve and cwe.

Fixes #1828
 2021-01-20 09:04:11 +01:00
Dirk WetterandGitHub 2627d9db13 Merge pull request #1825 from drwetter/fix_travis_3.0 
Travis CI didn't run. Trying to fix it (3.0)
 2021-01-18 09:15:14 +01:00
Dirk 4ee936dc52 Travis CI didn't run. Trying to fix it 2021-01-13 22:35:34 +01:00
Dirk WetterandGitHub 4b800b0ae5 Merge pull request #1822 from drwetter/fix_dot@NODE 
Fixes trailing dot error in URL handling (3.0)
 2021-01-13 21:56:48 +01:00
Dirk Wetter b8e76a3861 Fixes trailing dot error in URL handling 
For DNS queries a trailing dot in the variable $NODE is always fine. For
HTTP queries it is not. and causes the https request to fail.

Backport from 4f1da9b192

Also: removal of ancient CVS_REL relict in $TEMPDIR/environment.txt
 2021-01-13 11:35:31 +01:00
Dirk WetterandGitHub 666a2c4edb Merge pull request #1818 from drwetter/le_issuer_fix1816_3.0 
Fix issuer check for Let's Encrypt (3.0)
 2021-01-07 10:32:12 +01:00
Dirk Wetter 0de00f4322 Fix issuer check for Let's Encrypt (3.0) 
Fixes #1816 for 3.0 by a proper halving of the dates
 2021-01-07 10:29:08 +01:00
Dirk WetterandGitHub cb94ffaa13 Merge pull request #1796 from drwetter/no_code_update3.0 
Trying to save resources for Travis/CI (3.0)
 2020-11-28 10:15:13 +01:00
Dirk 98d1bd64bc Trying to save resources for Travis/CI (3.0) 
See https://github.com/google/EarlGrey/pull/383/files/3b38a5dea36a88aba42a42931e77a7c5429a1837
 2020-11-28 10:12:43 +01:00
Dirk WetterandGitHub dc08a120ba Merge pull request #1793 from drwetter/docker_docu_polish3.0 
Consolidate docker sections in Readme.md and Dockerfile.md (3.0)
 2020-11-27 16:54:26 +01:00
Dirk Wetter 7c835470be Consolidate docker sections in Readme.md and Dockerfile.md 
see #1791
 2020-11-27 16:53:28 +01:00
Dirk WetterandGitHub 7dac1a20f7 Merge pull request #1780 from drwetter/fix_1779 
Fix 1779
 2020-11-20 16:27:10 +01:00
Dirk ca89328ed4 Change version number 
To avoid clashes with distributors it may be is smarter to stick
to three numbers and not intoducing another digit.

3.0.4 <-- 3.0.3.1
 2020-11-20 11:09:17 +01:00
Dirk e441357efe Fix reading SSLv2 socket (3.0 branch) 
This fixes #1779. There was a problem introduced in
3c97412a61 which counted
the size of the file name rather than the size of the
socket reply.
 2020-11-20 11:06:22 +01:00
Dirk b08b5d8b98 Bump version to 3.0.3 2020-11-19 09:41:12 +01:00
Dirk WetterandGitHub 0abaa6d2bf Merge pull request #1774 from drwetter/ca-update_3.0 
Update certificate stores (3.0 branch)
 2020-11-14 11:11:03 +01:00
Dirk Wetter 2f18dcbd58 Update remaining stores: Apple / Java / Microsoft 
* also ca_hashes.txt

* Used Java SDK 15 instead of JRE 8
* Used Windows 10 20H2
* Java Keystore has added 5 certificates (90 --> 95)

Updated Readme and make instructions more reproducible

Fixes #1772
 2020-11-13 22:13:10 +01:00
Dirk WetterandGitHub d536c07b72 Merge pull request #1776 from drwetter/fix_1762_3.0 
Stop labeling X-XSS-Protection as green (3.0 branch)
 2020-11-13 15:24:22 +01:00
Dirk Wetter 99a158d952 Stop labeling X-XSS-Protection as green (3.0 branch) 
* X-XSS-Protection is now labled as a neutral finding as suggested in #1762
* Also it adds colons to header values

This a quick fix for the stable version as opposed to #1764 ff.
It also changes the color from lite cyan to neutral
 2020-11-13 13:57:21 +01:00
Dirk Wetter a180ec4f80 update Linux.pem + Mozilla.pem 2020-11-11 18:37:56 +01:00
Dirk WetterandGitHub f3abf77ed8 Merge pull request #1761 from keisentraut/fix-1757-3.0 
fix #1757: manpage: --c has one dash to much (backport 3.0)
 2020-10-29 20:28:23 +01:00
Dirk WetterandGitHub 0cf5a49762 Merge pull request #1759 from drwetter/fix_1754_3.0 
Fix run_freak() when sslv2 server hello is empty (3.0 branch)
 2020-10-28 15:05:51 +01:00
Dirk Wetter 3c97412a61 Address complaint by Travis + RC4 SSLv2 ciphers shortcut 
Despite the fact google doesn't support RC4 ciphers, testssl.sh called
sslv2_sockets(). Google answered with a >= TLS alert. Building a sum then
failed then in sslv2_sockets().

This fixes sslv2_sockets() and introduces count_chars() as a helper function
(tested also under old FreeBSD to make sure it works under MacOSX).

Also it adds a shortcut: if we are sure we don't have sslv2 we don't need
to test any RC4 SSLv2 ciphers
 2020-10-28 11:45:41 +01:00
Dirk 4ddc90d98d Fix run_freak() when sslv2 server hello is empty (3.0 branch) 
This fixes #1754 by avoiding further string operations if the SSLv2 socket reply is empty as bash 5.1 seems to have a problem with that. The fix is done in sslv2_sockets() .

Also sslv2 is not being used in run_freak() if known not to be supported.
 2020-10-27 22:48:50 +01:00
Dirk WetterandGitHub cd9b98ca70 Merge pull request #1727 from drwetter/fix_1725_SCIR_3.0 
Fix Secure Client-Initiated Renegotiation false positive (3.0 branch)
 2020-09-16 20:13:33 +02:00
Dirk 08feaf4a0c Fix Secure Client-Initiated Renegotiation false positive (3.0 branch) 
Server side closed the connection but openssl retrieved
a zero exit code. In addition now we look for "closed"
and if that was returned from the server we label it
as not vulnerable.

This fixes #1725.

Same fix as for 3.1dev, see #1726
 2020-09-16 18:13:47 +02:00
Dirk WetterandGitHub c0581afeeb Merge pull request #1712 from dcooper16/fix1699_3.0 
Fix #1699 in 3.0 branch
 2020-08-31 17:07:46 +02:00
Dirk d9866d875a Revised risk for BREACH --> medium 2020-07-10 19:56:18 +02:00
Dirk WetterandGitHub e1b0f2d55f Merge pull request #1673 from dcooper16/fix_unrecognized_option_3.0 
Fix printing of unrecognized option in 3.0 branch
 2020-07-07 15:54:11 +02:00
Dirk WetterandGitHub 2949b95937 Merge pull request #1667 from dcooper16/fix1665_3.0 
Fix #1665 in 3.0 branch
 2020-06-25 20:45:42 +02:00
Dirk WetterandGitHub 916d942b00 Merge pull request #1664 from dcooper16/fix1662_3.0 
Fix #1662 in 3.0 branch
 2020-06-25 13:40:41 +02:00
Dirk WetterandGitHub 2cdcf1564b Merge pull request #1661 from csett86/wireshark-android-7-0-backport 
Add wiresharked Android 7.0 (native) (backport of #1659)
 2020-06-25 08:31:17 +02:00
Dirk WetterandGitHub 594f09e858 Merge pull request #1647 from drwetter/fix_mxs_in_get_mx_record 
Fix wrong variable declaraton in get_mx_record()
 2020-05-26 09:35:54 +02:00
Dirk 11c03790bf Fix wrong variable declaraton in get_mx_record() 
mx was declared, mxs used instead. This fixes
it by correcting the declaration.
 2020-05-25 21:28:44 +02:00
Dirk WetterandGitHub c6ca746954 Merge pull request #1634 from drwetter/dockerfile+ 
Better Dockerfile: doesn't require "git clone"
 2020-05-09 12:54:02 +02:00
Dirk e5bb789dd3 Better Dockerfile: doesn't require "git clone" 
.. see also #1559.

It "mkdirs" the needed etc and bin directories first, then copies
stuff over. It also reduces a few layers.

Also it corrects a mistake in the Readme.md (docker exec --> run)
 2020-05-09 12:48:11 +02:00
Dirk WetterandGitHub 747b1e20ac Merge pull request #1633 from unit193/3.0 
Fix a couple typos.
 2020-05-09 12:20:03 +02:00
Dirk WetterandGitHub 4e887e3ee4 Merge pull request #1628 from drwetter/bump_version302 
Bump version to 3.0.2
 2020-05-08 11:44:48 +02:00
Dirk WetterandGitHub eb1398c04c Merge pull request #1627 from drwetter/dockerhub_workaround 
Provide the correct branch to Dockerhub builds
 2020-05-08 11:36:36 +02:00