Adds X-Permitted-Cross-Domain-Policies (already highlighted in emphasize_stuff_in_headers() but never reported), Origin-Agent-Cluster, Document-Policy, Clear-Site-Data, Reporting-Endpoints, Report-To and NEL to run_security_headers(), all presence-only/INFO, matching how COOP/COEP/CORP were added in #2619.
When a port was appended to the domain (e.g. "--mx example.com:25"), the suffix was passed straight into the MX DNS lookup, so no MX records were found. Strip a trailing :port off the domain before the lookup and use it as the port to test. Also fix the no-MX message, which printed $1 (the run date) instead of the domain, plus a "records(s)" typo.
run_security_headers() listed "Permissions-Policy" twice in its
header_and_svrty checklist: once as OK (since 2020) and again as INFO
(accidentally added in 12036fb). The loop matched the same header on
both iterations, emitting two entries to JSON (headerResponse) and the
terminal output. Remove the duplicate INFO entry, keeping the intended
OK classification.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
... which warns also via file output when not recommended command
line options are used.
This function named issue_cmdline_warnings() is being called in
lets roll after all fileout() functions has been initialized.
It needs to make use of fileout_insert_warning() though because
otherwise the JSON output is not correct.
Besides the previoulsy introduced warning when scanning IP addresses,
warnings of usage of '--fast' and '--ssl-native' will end up also
in a file now which gives ther tools using the machine readable
output to detect bad scan conditions.
Also warnings when scanning the most known IPv4 addresses
from Cloudflare, Google and Quad9, are avoided.
* move message when scanning IP address to the very beginning, inside parse_cmd_line()
* improve message
* just check whether there are no chars a-zA-Z
* move [[ $caa_node =~ '.'$ ]] || caa_node+="." into the while loop
- Skip CAA lookup entirely when NODE is an IP address; show
"not checked (IP address scan)" instead of spuriously querying
IP octets as domain labels and reporting "not offered"
- Force FQDN (trailing dot) on the initial caa_node before the
walk loop so dig does not apply the resolv.conf search domain
to the first query, which could return a false result
- Add a visible warning in the scan header when scanning by IP
address, noting that trust/CAA and other domain-specific checks
may be unreliable and the user should rescan with the hostname
went through a couple of pcap files and determined ja3 + ja4 sums.
- Android 15/16 are the same (previously ja3 taken instead of ja4 and wrong host. One has to use chrome !)
- Edge 101/Chrome 101 are the same (will be deprated next time)
- surprisingly Java 17.0.3 and 21.0.6 were the same.
- Added: Ja3/ja4 for old Apple Mail and Thunderbird
As mentioned in the comment: For Androids ja3 is is not unique, probably because of GREASE.
One can add two handshakes after another and they are different. ja4 seems more consistent here.
This should be kept in mind for all clients "supplying some grease"
The trailing error messages were swapped in the paragraphs /
description for MAX_SOCKET_FAIL + MAX_OSSL_FAIL .
This fixes the confusion for 3.3dev , see #3028 .
This fixes#3003 .
The conversion to proper UTF-8 should have taken place by just using
`-nameopt RFC2253`, see manpage openssl-namedisplay-options(1ssl).
As @dcooper16 suggested removing esc_msb should help. This may look
counterintuitive but works.
This commit changes the way that TLS 1.3 ciphers are identified by the OpenSSL names. To the degree possible, rather than checking for prefixes that have historically been used in various versions of OpenSSL and LibreSSL, the cipher name being checked against the known list of TLS 1.3 cipher suites that $OPENSSL supports.
In the few places in which the cipher suite name to be checked may not be supported by $OPENSSL, a check for the prefix "TLS_" is also used.
Dirk Wetter