Git/testssl.sh
1
0
Fork 0
mirror of https://github.com/drwetter/testssl.sh.git synced 2026-09-14 13:48:16 +02:00
Code Issues Packages Projects Releases Wiki Activity
5,381 Commits 16 Branches 39 Tags
ea16c81e971370e15b992c0b7eefedbc066b9085
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Dirk WetterandGitHub ea16c81e97 Fix badges, try 2 
* comment in status badges (try)
* stars getting to work again
 2026-06-09 09:57:21 +02:00
Dirk WetterandGitHub fe080150cf Merge pull request #3053 from testssl/drwetter-patch-1 
Handle badges, remove 1 bracket
 2026-06-09 09:45:10 +02:00
Dirk WetterandGitHub 1bf15f41e1 Handle badges 2026-06-09 09:42:50 +02:00
Dirk WetterandGitHub cfde1df489 Merge pull request #3050 from potato-20/add-modern-security-headers 
Report additional modern security headers (INFO)
 2026-06-09 09:22:54 +02:00
Dirk WetterandGitHub 8f588813c0 Merge pull request #3049 from potato-20/fix-mx-host-port-2986 
Fix --mx host:port parsing and incorrect no-MX message (#2986)
 2026-06-08 18:33:32 +02:00
Dirk WetterandGitHub 654dc18760 Merge pull request #3052 from testssl/mac_runner_update 
Update runner to macos-26 (arm64 as before)
 2026-06-08 17:08:16 +02:00
Dirk Wetter 3c5b733431 Update runneer to macos-26 (arm64 as before) 
... as they were strange failures in the past.

Supported runners: https://docs.github.com/en/actions/reference/runners/github-hosted-runners#single-cpu-runners .
Details: https://github.com/actions/runner-images/blob/main/images/macos/macos-26-arm64-Readme.md
 2026-06-08 16:41:37 +02:00
Dirk WetterandGitHub 7f63e73ec3 Merge pull request #3046 from SteveVaneeckhout/fix-permissions-policy-duplicate 
Fix Permissions-Policy header listed twice in output
 2026-05-30 17:47:56 +02:00
Dirk WetterandGitHub 316b1a8014 Merge pull request #3045 from testssl/add_fs_data_clientsimulation_json 
Add fs data clientsimulation json
 2026-05-29 16:07:24 +02:00
Dirk 209e76541e Using a compariable Linux distro in the firstplace for updating handshake would have been great ;-) 2026-05-29 15:20:17 +02:00
Dirk ec99148700 Fix html output runner 2026-05-29 13:00:58 +02:00
Dirk 1ee1a60a99 var name append_fileout is clearer 2026-05-29 10:53:28 +02:00
Dirk 566e1b1f65 Fix diff complaint raised by ./t/12_diff_opensslversions.t 2026-05-29 10:33:03 +02:00
Dirk cff2c0810c Add Linux, not Mac baseline ;-) 2026-05-28 20:41:00 +02:00
Dirk Wetter 01d58f5e9c update client simulation data 2026-05-28 19:07:28 +02:00
Dirk Wetter cf66ad61bd Add forward secrecy data to file output 
This fixes #3040 .

Also this removes the debug lines within the if statement (bottom of run_client_simulation() ), probably
a historic leftover.
 2026-05-28 19:03:39 +02:00
Dirk WetterandGitHub 9567e65a01 Merge pull request #3043 from testssl/issue_cmdline_warnings 
Introduce early warning function
 2026-05-28 13:31:27 +02:00
Dirk Wetter 75376d38bf Introduce early warning function 
... which warns also via file output when not recommended command
line options are used.

This function named issue_cmdline_warnings() is being called in
lets roll after all fileout() functions has been initialized.
It needs to make use of fileout_insert_warning() though because
otherwise the JSON output is not correct.

Besides the previoulsy introduced warning when scanning IP addresses,
warnings of usage of '--fast' and '--ssl-native' will end up also
in a file now which gives ther tools using the machine readable
output to detect bad scan conditions.

Also warnings when scanning the most known IPv4 addresses
from Cloudflare, Google and Quad9, are avoided.
 2026-05-28 10:37:16 +02:00
Dirk WetterandGitHub ca99b45f1f Merge pull request #3042 from testssl/grhza-3.3dev 
Improve PR #3041
 2026-05-27 18:16:42 +02:00
Dirk Wetter f8af511952 Improve PR #3041 
* move message when scanning IP address to the very beginning, inside parse_cmd_line()
* improve message
* just check whether there are no chars a-zA-Z

* move [[ $caa_node =~ '.'$ ]] || caa_node+="." into the while loop
 2026-05-27 16:53:06 +02:00
Dirk WetterandGitHub 2f51cff728 Merge pull request #3039 from phpipam/3.3dev 
Added link to php-ssl Certificate scanning integration
 2026-05-19 17:27:07 +02:00
Dirk WetterandGitHub 84235d35c0 Merge pull request #3038 from testssl/more_handshakes_updates 
Client handshake updates
 2026-05-18 22:14:26 +02:00
Dirk 7871d800f9 adjust baseline runner output 2026-05-18 21:30:57 +02:00
Dirk 01b7ad7cc8 correct name 2026-05-18 21:30:34 +02:00
Dirk 56697cee48 Consolidate handshakes for all Safaris 26.4 
Looked before at ja3, but for Chromium-browsers ja4 is relevant.
The client column needed to be extended with 1 space.
 2026-05-18 21:16:43 +02:00
Dirk b4e58dfbb5 Consolidated Handshakes 
went through a couple of pcap files and determined ja3 + ja4 sums.

- Android 15/16 are the same (previously ja3 taken instead of ja4 and wrong host. One has to use chrome !)
- Edge 101/Chrome 101 are the same (will be deprated next time)
- surprisingly Java 17.0.3 and 21.0.6 were the same.

- Added: Ja3/ja4 for old Apple Mail and Thunderbird
 2026-05-18 18:45:04 +02:00
Dirk 7897cdcd84 Android 16 
As mentioned in the comment: For Androids ja3 is is not unique, probably because of GREASE.
One can add two handshakes after another and they are different. ja4 seems more consistent here.

This should be kept in mind for all clients "supplying some grease"
 2026-05-18 16:50:06 +02:00
Dirk 56e4a74485 Add OpenSSL 4.0 2026-05-17 15:23:42 +02:00
Dirk a35e9f816d Broaden table for client simulation 
... as some clients are the same and space wasn't enough.
 2026-05-16 16:14:24 +02:00
Dirk dd4c0b371d Handshakes for iOS + iPadOS 26.4. added 2026-05-16 16:04:13 +02:00
Dirk 7be3897437 Update MacOS/Safari 26.4 
it has PQC kx finally, whohoo
 2026-05-15 21:31:06 +02:00
Dirk 14e8df3fab Update readme wrt ja3/ja4 + imotr tweaks 2026-05-15 21:30:07 +02:00
Dirk 60131b4b5d - Update Apple Client Simulations 2026-05-15 21:28:54 +02:00
Dirk WetterandGitHub 0e59b983f1 Merge pull request #3030 from testssl/fix_unicode_3003 
Fix DN conversion when reading certificate issuer
 2026-04-22 15:34:21 +02:00
Dirk WetterandGitHub 146605e740 Merge pull request #3031 from testssl/fix_doc-problem_3029 
Fix doc error regarding MAX_SOCKET_FAIL + MAX_OSSL_FAIL
 2026-04-20 18:58:51 +02:00
Dirk b773fa9939 Fix doc error regarding MAX_SOCKET_FAIL + MAX_OSSL_FAIL 
The trailing error messages were swapped in the paragraphs /
description for MAX_SOCKET_FAIL + MAX_OSSL_FAIL .

This fixes the confusion for 3.3dev , see #3028 .
 2026-04-20 18:43:59 +02:00
Dirk b573a4f786 Fix DN conversion when reading certificate issuer 
This fixes #3003 .

The conversion to proper UTF-8 should have taken place by just using
`-nameopt RFC2253`, see manpage openssl-namedisplay-options(1ssl).

As @dcooper16 suggested removing esc_msb should help. This may look
counterintuitive but works.
 2026-04-20 18:09:36 +02:00
Dirk WetterandGitHub d2d684e31b Merge pull request #3029 from testssl/fix_fix_2809 
Address missing extended_master secret extension properly
 2026-04-20 17:49:24 +02:00
Dirk cff949bb90 Address missing extended_master secret extension properly 
This PR "fixes feature" #2809 which was formerly not properly implemented in #2982,
see comment https://github.com/testssl/testssl.sh/issues/2806#issuecomment-4164847538.

Now TLS 1.3.-only servers won't get penalized when the master secret extension
is missing.
 2026-04-20 16:31:44 +02:00
Dirk WetterandGitHub 7c47d8a8eb Merge pull request #3023 from dcooper16/identity_ossl_tls13_ciphers 
Identify TLS 1.3 ciphers by OpenSSL name
 2026-04-17 11:59:10 +02:00
Dirk WetterandGitHub 24eb5dec8a Merge pull request #3024 from dcooper16/missing_groups 
Add missing TLS 1.3 Brainpool groups
 2026-04-15 11:41:14 +02:00
Dirk WetterandGitHub 57cca5c2a0 Merge pull request #3020 from dcooper16/use_sigalgs 
Use OpenSSL with -sigalgs option to obtain server's certificate
 2026-04-13 09:36:47 +02:00
Dirk WetterandGitHub 93ae5d78f4 Merge pull request #3021 from dcooper16/missing_sigschemes 
Add missing TLS signature schemes
 2026-04-13 09:34:20 +02:00
Dirk WetterandGitHub e3ec72a359 Merge pull request #3018 from dcooper16/ossl4_ocsp 
OpenSSL 4 compatibility for stapled OCSP responses
 2026-04-12 13:24:01 +02:00
Dirk WetterandGitHub b14ed4def5 Merge pull request #3017 from dcooper16/tls_data 
Clean up etc/tls_data.txt
 2026-04-11 11:22:17 +02:00
Dirk WetterandGitHub 012a296184 Merge pull request #3015 from testssl/dcooper16-1 
Add draft-yang-tls-hybrid-sm2-mlkem
 2026-04-09 11:53:23 +02:00
Dirk WetterandGitHub e370aabb33 Update CREDITS.md 2026-04-09 11:52:50 +02:00
Dirk WetterandGitHub 48b29194b9 Add draft-yang-tls-hybrid-sm2-mlkem 2026-04-09 11:43:02 +02:00
Dirk WetterandGitHub adff28d50c Merge pull request #3014 from dcooper16/rfc8998 
Add support for RFC 8998 and draft-yang-tls-hybrid-sm2-mlkem
 2026-04-09 11:29:08 +02:00
Dirk WetterandGitHub 3f9eb84778 Merge pull request #3012 from testssl/fix_3009_date-detection 
Make sure date -r hits a dir readable
 2026-04-07 16:00:04 +02:00
Dirk Wetter ec95862790 Make sure date -r hits a dir readable 
When checking early for date flavors, there might be an edge case when
a directory with a referred file (for the date command) isn't readable
which might cause testssl.sh to not detect the date flavor correctly.

This fixes that by cd'ing to / in a subshell which should be cd'able
and readable under every platform.
 2026-04-07 10:27:46 +02:00
Dirk WetterandGitHub 802061f492 Merge pull request #3010 from testssl/patch-1 
Fix typo
 2026-04-07 09:48:37 +02:00
Dirk WetterandGitHub 693a7c1682 Fix typo 2026-04-07 09:47:36 +02:00
Dirk WetterandGitHub 5958f063f6 Merge pull request #3005 from dcooper16/ossl4 
OpenSSL 4 compatibility
 2026-03-25 09:49:42 +01:00
Dirk WetterandGitHub 9c086b2e15 Merge pull request #3002 from testssl/dependabot/github_actions/docker/build-push-action-7 
Bump docker/build-push-action from 6 to 7
 2026-03-12 11:02:37 +01:00
Dirk WetterandGitHub 3142e73b99 Merge pull request #3001 from testssl/dependabot/github_actions/docker/setup-buildx-action-4 
Bump docker/setup-buildx-action from 3 to 4
 2026-03-12 11:02:13 +01:00
Dirk WetterandGitHub a24990ef90 Merge pull request #3000 from testssl/dependabot/github_actions/docker/metadata-action-6 
Bump docker/metadata-action from 5 to 6
 2026-03-12 11:01:45 +01:00
Dirk WetterandGitHub 63a07e38e1 Merge pull request #2999 from testssl/dependabot/github_actions/docker/setup-qemu-action-4 
Bump docker/setup-qemu-action from 3 to 4
 2026-03-12 11:01:01 +01:00
Dirk WetterandGitHub a7f16fd189 Merge pull request #2998 from testssl/dependabot/github_actions/docker/login-action-4 
Bump docker/login-action from 3 to 4
 2026-03-12 11:00:30 +01:00
Dirk WetterandGitHub 87ecc1c9f2 Merge pull request #2997 from testssl/drwetter-patch-1 
don't use 3.0 docker images anymore
 2026-02-19 10:53:34 +01:00
Dirk WetterandGitHub 81fb5f967f don't use 3.0 anymore 2026-02-19 10:52:31 +01:00
Dirk WetterandGitHub 552e10ce8a Merge pull request #2995 from testssl/drwetter-patch-1 
Amend IPv6 with host networking
 2026-02-18 10:32:48 +01:00
Dirk WetterandGitHub 8aca6f0665 Amend IPv6 with host networking 2026-02-18 10:31:24 +01:00
Dirk WetterandGitHub aef8616e5b Merge pull request #2992 from testssl/back2thedev 
Change banner back to 3.3dev
 2026-02-18 10:25:29 +01:00
Dirk WetterandGitHub 4086cb593e Merge pull request #2994 from testssl/drwetter-patch-1 
Docker + IPv6
 2026-02-18 10:01:48 +01:00
Dirk WetterandGitHub 6cc8c857a8 Docker + IPv6 2026-02-18 10:00:57 +01:00
Dirk 094c61caea Change banner back to 3.3dev 2026-02-13 14:25:58 +01:00
Dirk WetterandGitHub cdc892e323 Merge pull request #2991 from testssl/3.3snap1 
Add "dev" to the version banner to clarify
 2026-02-13 13:46:54 +01:00
Dirk c895a5c268 Add "dev" to the version banner to clarify 
And modify the banner accordingly depending on whether it's a
snapshot release or not.
 2026-02-13 11:18:13 +01:00
Dirk WetterandGitHub a9fc8a17c5 Merge pull request #2989 from testssl/3.3snap1 
Prepare for a snapshot release
 2026-02-13 08:36:20 +01:00
Dirk c600b2cb38 Prepare for a snapshot release 
- "3.3" still signals it's not oldstable
- "snapshot-YYMM" speaks for itself
 2026-02-12 23:15:07 +01:00
Dirk WetterandGitHub 18a1264223 Merge pull request #2985 from testssl/fix_2983_robot_timeout 
Finalize renaming MAX_WAITSOCK --> ROBOT_TIMEOUT
 2026-02-11 21:36:17 +01:00
Dirk ee316ef7ee Google has KEMs wjhich openssl doesn't show 2026-02-11 20:06:24 +01:00
Dirk 98d3c8399f Fix typo in ROBOT_TIMEOUT 
... which may led to false positives

Also in a number of tests the timeout was re-adjusted so that the robot check
performs ~25% faster -- on MacOS. On Linux it's about the same.
 2026-02-11 19:00:38 +01:00
Dirk 496373a60f Finalize renaming MAX_WAITSOCK --> ROBOT_TIMEOUT 
The commit 51a35b0344 changed variable names but there were leftovers. Also
before the tiemout values were reduced, so that the check may run faster. What was left were that some
timeout values were still too long. Thus MAX_WAITSOCK is now completely changed to ROBOT_TIMEOUT .
Also when the ROBOT check identified something as potentially vulnerable, the timeout value ist increased to
8 seconds which is less than in 3.2 . Tests however showed so far that there were no false positives or
negatives.

Moreover it changes the local variable robottimeout to robot_timeout.

This PR fixes #2983 for 3.3dev .
 2026-01-22 19:57:32 +01:00
Dirk WetterandGitHub 79db2763b6 Merge pull request #2982 from testssl/feature_2806 
Flag absence of extended master secret extension
 2026-01-15 15:19:45 +01:00
Dirk ca55c5b180 Exempt the debug statement "Extended master secret extension detected" 2026-01-15 11:20:01 +01:00
Dirk d78fae2dce Add extended_master_secret extension 2026-01-14 20:37:33 +01:00
Dirk 52ffa95696 Flag absence of extended master secret extension 
This PR fixes #2806 and implements a feature request. TLS >=1.2 MUST support
support the extended_master_secret extension to address an attack resulting
from TLS session parameters not being properly authenticated in a Triple
Handshake scanario (https://ieeexplore.ieee.org/document/6956559).

Only if the extension is missing there will be a medium severity level
finding. JSON output will be generated in any case.

Also in determine_tls_extensions() some documenation about tls extensions
to be send were added.
 2026-01-14 20:22:59 +01:00
Dirk WetterandGitHub 251d5ac02a Merge pull request #2981 from testssl/fix_2973 
Remove VULN_THRESHLD relic
 2026-01-13 20:05:44 +01:00
Dirk cf77cd2ad4 fix spelling 2026-01-13 17:33:33 +01:00
Dirk 3e10b3a9a2 Remove VULN_THRESHLD relic 
This fixes #2973.

There was a while back an extra headline when one or a defined other
number of vulnerabilities were checked. The extra headline was removed
n #2967 but some leftover code needed to be removed as well.

In the aforementioned previous PR it seems run_starttls_injection()
and run_rc4() were forgotten. This PR removes extra headlines in
those functions as well.
 2026-01-13 17:24:27 +01:00
Dirk WetterandGitHub 4e10bd24da Merge pull request #2979 from testssl/drwetter-patch-1 
general remarks, check boxes
 2026-01-13 10:36:30 +01:00
Dirk WetterandGitHub 62934191d3 minor tweaking 2026-01-13 10:35:50 +01:00
Dirk WetterandGitHub edbec494c6 Merge pull request #2980 from testssl/OPENSSL2_hint 
Suggest alternative $OPENSSL2 when $OPENSSL fails
 2026-01-13 10:30:31 +01:00
Dirk 45b27872c9 fix typo 2026-01-12 21:22:45 +01:00
Dirk d360b27b83 Suggest alternative $OPENSSL2 when $OPENSSL fails 
.. as an UI improvement for the user.

Implemented for Ticketbleed and during startup in determine_optimal_proto() .
For the latter it could be considered later to automagically pick $OPENSSL2 .
 2026-01-12 21:07:15 +01:00
Dirk WetterandGitHub 2ea57ec490 typos 2025-12-26 20:28:28 +01:00
Dirk WetterandGitHub c89a41e627 general remarks, check boxes 2025-12-26 20:26:26 +01:00
Dirk WetterandGitHub 6a5a69fcfd Merge pull request #2978 from testssl/drwetter-patch-1 
Polish
 2025-12-20 23:24:50 +01:00
Dirk WetterandGitHub f16e270e6a Polish 2025-12-20 23:24:15 +01:00
Dirk WetterandGitHub ee8055ef61 Merge pull request #2977 from testssl/drwetter-patch-1 
Add FAQ
 2025-12-20 23:19:59 +01:00
Dirk WetterandGitHub 1650b445ef Add FAQ 2025-12-20 23:19:22 +01:00
Dirk WetterandGitHub 4c27d8a8b9 Merge pull request #2975 from testssl/badges_patch 
Update badges
 2025-12-19 15:19:34 +01:00
Dirk WetterandGitHub 2274c6cd5b Merge pull request #2974 from testssl/robot_timeout_doc 
Add ROBOT_TIMEOUT to documentation
 2025-12-19 15:18:50 +01:00
Dirk bca823a0cc Update badges 
- sort them better
- add forks+stars
- remove gitter
 2025-12-19 15:17:07 +01:00
Dirk 3ac39032fa Add ROBOT_TIMEOUT to documentation 
Also
* remove VULN_THRESHLD from docs

Note: pandoc was a different version, so the roff output has different
encodings for different special chars.
 2025-12-19 15:07:40 +01:00
Dirk WetterandGitHub 61d0189f8f Merge pull request #2969 from testssl/mitigate_2083 
Mitigate inconsistent test results for ROBOT
 2025-12-19 13:59:48 +01:00
Dirk Wetter 6cd5b4364c Merge branch '3.3dev' into mitigate_2083 2025-12-15 13:13:50 +01:00
Dirk WetterandGitHub 28baa6be44 Merge pull request #2968 from testssl/fix_missing_vulnHeadline 
ROBOT is also a vulnerability
 2025-12-15 13:12:56 +01:00