Git/testssl.sh
1
0
Fork 0
mirror of https://github.com/drwetter/testssl.sh.git synced 2026-09-14 13:48:16 +02:00
Code Issues Packages Projects Releases Wiki Activity
332 Commits 16 Branches 39 Tags
faa9c49a2bee52f18c74495d95d1d99d160a00e1
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Dirk 9b2b897a43 - make date even more beautiful, see #110 
- fix RUN_DIR
 2015-05-29 14:12:22 +02:00
Dirk Wetter df3b9019a1 Update Readme.md 2015-05-29 13:37:37 +02:00
Dirk Wetter e14453b607 Merge pull request #110 from AntonioMeireles/master 
simplify life for OSX users running gnu's coreutils...
 2015-05-29 11:01:47 +02:00
Dirk 4e18c35271 Merge branch 'master' of github.com:drwetter/testssl.sh 2015-05-29 10:36:47 +02:00
Dirk 41ee37f0dc - per default we do a allciphers run in the end 
- option long changed to wide
- PFS now is per default not wide
- PFS comes after standard cipher lists
- debug output improved (in terms of privacy and additional info)
 2015-05-29 10:36:14 +02:00
Dirk b48ac9874e - early check to make sure people really use bash, see #109 2015-05-29 10:10:53 +02:00
Dirk 2ac34c1424 - early check to make sure people really use bash, see #109 2015-05-29 10:08:17 +02:00
Dirk Wetter 8b10dc9638 - code improvements rc4, beast, logjam, freak 2015-05-27 23:31:25 +02:00
Dirk Wetter f9605c4f35 - BEAST now also works in wide mode 
- renamed --long in --wide
- added --show-each to help
- inserted help
 2015-05-27 17:04:35 +02:00
Dirk Wetter a76ca52c4c - first candidate for logjam (missing the precomuted primes though) 
- 1024 DH is now brown instead of red, 768 will be red, 512 bold red
- dumped calls to ok()
- further cosmetic stuff
 2015-05-27 14:28:18 +02:00
Dirk f261884499 Merge branch 'master' of github.com:drwetter/testssl.sh 
Conflicts:
	testssl.sh
 2015-05-27 11:24:47 +02:00
Dirk ed38a365ae - fix regression on missing rfc cipher names 
- cosmetic stuff
 2015-05-27 11:19:30 +02:00
Dirk Wetter efffe9867b - FIX: cipher mapping 
- adjust trailing spaces missing b4
 2015-05-26 19:26:21 +02:00
Dirk Wetter c7a76d9b86 - typo/ c&p error with dh func 
- fixed uninitialised var
 2015-05-26 15:59:27 +02:00
Dirk d58f39d008 - logjam 2015-05-26 12:57:15 +02:00
Dirk 8ab0aef84b Merge branch 'master' of github.com:drwetter/testssl.sh 2015-05-26 12:56:17 +02:00
Dirk 060178071d - for pfs. allciphers and cipher_per_proto we WARN now because of weak DH param (if openssl supports it) 
FIX #106, $85
- logjam not yet named *#105, #107) but addressed
- --openssl switch
- reorder find_openssl_binary / mybanner
- proper identation of help
 2015-05-26 12:51:10 +02:00
Dirk Wetter 9b13160953 Update Readme.md 2015-05-25 21:41:45 +02:00
Dirk 3c161f9ce4 - blanks in headlines added 2015-05-25 21:22:21 +02:00
Dirk 9c7d385098 - omit 1xblank in almost all colored output (and adjust the functions using it) 
- little bit more robust for strange keysize and dh bits
- added ecdsa-with-SHA256 to Signature Algorithm
- FIX: no TLS1+SSL3 resulted in no output for BEAST
 2015-05-25 21:14:59 +02:00
Dirk e58b53eeae - dh key lenghth in negotiated cipher at first, see $85, #105, #106 
- got rid of ok function calls in protocols
- detection of apache banner win32/win64
 2015-05-25 15:10:09 +02:00
Dirk a7a19428d6 - FIX for #104: check for hpkp pin match failed if \" was present 2015-05-18 23:10:34 +02:00
Dirk 0c4a36121e - NEW / FIX #104: check for hpkp pin match 2015-05-18 21:51:45 +02:00
Dirk Wetter bf7b867d86 Update Readme.md 2015-05-17 22:56:38 +02:00
Dirk 7cc15e5d4d - 2.4 2015-05-17 22:43:53 +02:00
Dirk 43732ae53d Merge branch 'master' of github.com:drwetter/testssl.sh 2015-05-17 22:42:53 +02:00
Dirk 4e7bbb20a0 - 2.4 2015-05-17 22:41:58 +02:00
Dirk 1c509bf845 2015-05-17 22:34:50 +02:00
Dirk 2919a7c40e - 2.4! 
- FIX #92
- FIX for TLS time (difftime was too small for local clock skew)
- warning for freebsd/macosx w/o ports need now a "yes"
- TLS 1.0 not offered is not bold anymore
- output weirdness fixed for cipher order in spdy
 2015-05-17 22:30:49 +02:00
Dirk 6e74b3bd5c - FIX of output whene there's no CBC cipher in BEAST 
- FIX: 2 occurrances of OPENSSL calls had a hostname instead of an IP address
- FIX: starttls protocol correctly displayed
- NEW added duplicate detection for header flags
- NEW: added four GOST cipher to standard socket handshake
- recommends if openssl 1.0.2 is used and results were strange and IIS6 --> run wqith openssl 1.0.1
- declared some global vars as readonly
 2015-05-15 21:32:11 +02:00
Dirk Wetter 7741d99cc8 Update Readme.md 2015-05-12 13:42:42 +02:00
Dirk 7614ac6f87 Merge branch 'master' of github.com:drwetter/testssl.sh 2015-05-12 13:38:20 +02:00
Dirk 16d2b33459 - Workarounds for IIS6 #99 : some places where openssl 1.0.2 cannot connect (as opposed 
to =< 1.0.1) finding the right protocol before
- hints for IIS6+openssl 1.0.2 non-conformity #99
- version bumped up to 2.4rc2
- better formatting for BSD in cipher order
- FIX: 2x bug for cipher order + sslv2
- preambel revisited
 2015-05-12 13:37:39 +02:00
Dirk Wetter a7d7158c4b Update Readme.md 2015-05-12 10:21:31 +02:00
Dirk 3a64bd1005 - WONTFIX remarks for #103 and #102 
- better warning for openssl < 1.0
 2015-05-11 16:58:57 +02:00
Dirk 35d8469f67 URL_PATH regression fixed 2015-05-11 10:47:26 +02:00
Dirk 08fe890d5f - two fixes from #40 reported by @salt-lick 2015-05-11 08:52:40 +02:00
Dirk 19fc021587 - FIX: 30x with BigIP doesn't have a date, handled properly now 
- generic GET/HEAD is now always with URL_PATH
 2015-05-10 23:38:06 +02:00
Dirk 0050df5529 - informative header extended 2015-05-10 20:54:43 +02:00
Dirk 2f79ba52fc - NUMEROUS FreeBSD9/Darwin FIXES #40 
- http date
  - cipher list in preferences
- GET_REQ11 now closes the connection
- openssl_age comes afeter the banner so that help doesn't need to go thru this
- uname -s ==> SYSTEM
 2015-05-10 19:20:55 +02:00
Dirk 0aa8ac7e76 - more robust wrt IIS6 (some stuff better with IIS7) 
- X-Powered-By is easy to remove (PHP, ASP.NET), thus labelled as yellow
- same X-AspNet-Version (version # itself is brown)
- better addressed address resolution failures ;-)
- bumped up version to 2.4rc1
 2015-05-06 18:48:51 +02:00
Dirk f3f3967bd1 - FIX $87 (2), finally 
- feature: integrated TLS+HTTP time into server defaults
- NEW: option: -U/vulnerable
- moved explanation for BREACH into result
- FREAK and CCS are not labled experimental anymore
- unifying of get request headers
- readability of help
 2015-05-02 15:01:02 +02:00
Dirk Wetter 2aa82e5164 - partly FIX for #87 (removed SNI helps. Doesn't make sense anyway) 
- changed order of Secure Renegotiation/Secure Client-Initiated Renegotiation
- readability improvements in renego
 2015-05-01 12:18:43 +02:00
Dirk d766a0b459 - fix additional \n in RC4 if no RC4 ciphers were detected 2015-04-28 08:04:09 +02:00
Dirk Wetter ae1abda571 Update Readme.md 2015-04-24 16:52:08 +02:00
Dirk 150fb671bb - more thourough what has been done 2015-04-23 09:25:28 +02:00
Dirk Wetter b492031b95 Update Readme.md 2015-04-23 08:48:28 +02:00
Dirk 1ea7a0947f - RC4 has now 2 CVEs and cipher per default are displayed short 
- introducng a variable name LONG which for certain funcs shows broad output with hexc, cipher, KX, etc.
- FIX: regression not showing security headers
- introducing VULN_THRESHLD
 2015-04-22 18:24:39 +02:00
Dirk 3891f5b13b - FIX #83 
- emphasize also OS names in HTTP headers
 2015-04-22 15:22:53 +02:00
Dirk 06bd8b2517 - FIX for complete bailing out 2015-04-22 11:56:13 +02:00
Dirk bafce6edce - reordering code so that all attacks are together 
- RC4 is now really omitted in PFS test
- cleanup of some comments
 2015-04-22 10:33:44 +02:00
Dirk c751e9f459 typo 2015-04-21 08:14:36 +02:00
Dirk 5bec0a16c9 - better compatibility with windows 2003 server 
- all long options are advertised now as with dashes and not underscore
- cosmetic stuff
 2015-04-20 10:05:01 +02:00
Dirk 7b6dba6369 FIX for #82 2015-04-18 23:03:16 +02:00
Dirk Wetter 3f0f489f50 Indicated freeze 2015-04-16 21:05:23 +02:00
Dirk 5625ee536e - BUGFIX: IIS server lead to false pisitive if SSLv3 was enabled 
(timeout was faster then socket resply)
- FIX: CORS header not labeled as green
- NEW: Now also STARTTLS works with all cmd line options and is absolutely doing the same stuff!
  (integrated starttls() into parse_hn_port() )
- option --mx needed to be changed because of starttls
- regression fix: exec for socket doesn't play nice with stderr redirect
  (probably bash bug)
- added some env options to cmd line as long args (--assuming-http,--ssl_native,
  --color, debug, --sneaky, --warnings)
- threw away getent as it doesn't work under Linux && not network && localhost
  (replaced by grep)
- SSL-POODLE is not labeled anymore experimental
- HB+CCS are called while checking STARTTLS but given a hint that its not yet supported
- added more env vars to debug output
- cleanups
 2015-04-16 20:36:17 +02:00
Dirk f682c5ceea - FIX regression: more_flags execution was missing 
- FIX regression: capitalized/all lowercase headers weren't detected
- if socksend is blocked (IDS) output looks better and is reported as test didn't succeed
- no secure cookie or Httponly will be marked as brown
- tput color yellow is now brown
 2015-04-14 13:16:43 +02:00
Dirk 9d5168dbb5 - more robust grep >=2.20, e.g Debian 8.0 (thx @stevenb18) 
- FIX: false positive for breach while testing google.com (referer header was hardcoded to google.com)
 2015-04-14 10:15:07 +02:00
Dirk 683e9dccab - FIX (regression): -V 
- logic of some ENV variables changed (attention!)
- included some ENV as long options (not in the help yet)
- decentralized http check for breach
- if openssl is not executable it bails out better now
- help function now exits
 2015-04-13 22:55:40 +02:00
Dirk 1043c40a60 Merge branch 'master' of github.com:drwetter/testssl.sh 2015-04-10 15:16:20 +02:00
Dirk a12d39769f - underline CN, SAN and issuer deutschepost case (see sourceforge.net/p/ssllabs/mailman/message/33764851/) 2015-04-10 15:15:47 +02:00
Dirk Wetter bfcd684e19 Update Readme.md 2015-04-10 10:13:30 +02:00
Dirk Wetter 9ebf112858 Update Readme.md 2015-04-09 22:24:57 +02:00
Dirk 53e0955dfb FIX: missing server preferences, NEW: each cipher server preferences per protocol! 2015-04-09 22:08:48 +02:00
Dirk 7f984ea83f - 2015-04-09 21:45:22 +02:00
Dirk a98161acc9 - fixes to changes from Peter's better cmd line parsing 
- cosmetc improvements (vulneraibilities)
 2015-04-09 21:42:52 +02:00
Dirk Wetter eb73ffc053 Merge pull request #79 from PeterMosmans/refactoring 
Refactored major parts of code
 2015-04-09 21:38:29 +02:00
Dirk 84aca9d9a3 FIX #80: show HTTP 401 2015-04-02 13:35:22 +02:00
Dirk 2cc56c4d1f NEW: added security headers 2015-04-02 13:04:57 +02:00
Dirk 8da96f78f2 - got rid of "strings" 2015-04-02 12:19:24 +02:00
Dirk 4bbd19ba03 - updated binaries from Peter. Necessary because handshake under rare circumstances 
failed (routines:tls1_setup_key_block:cipher or hash unavailable:t1_enc.c:802.
  SLES 12 server, some ciphers under TLS 1.2
 2015-04-02 11:46:12 +02:00
Dirk 940f51e74b protocol check via sockets now also for SSLv3 2015-03-31 10:34:30 +02:00
Dirk 9ed58b6202 cleanups / bsd date in tls time 2015-03-30 23:09:19 +02:00
Dirk 6c30386278 rechi 2015-03-30 15:03:29 +02:00
Dirk d9ae35fc7e open fixes from Rechi (pull request $67) 2015-03-30 14:59:44 +02:00
Dirk Wetter 7f4fc5902e Merge pull request #75 from feld/tr 
Using square brackets in tr results in trying to match/replace them
 2015-03-19 09:14:54 +01:00
Dirk Wetter f4c9f692d2 Merge pull request #76 from feld/printf 
Fix variable directly referenced in printf
 2015-03-19 09:14:32 +01:00
Dirk 0d3b7f343f Дилян 2015-03-17 22:14:05 +01:00
Dirk 2d0bfca343 - FIX for 3des cipher report (thx Дилян) 2015-03-17 22:12:25 +01:00
Dirk ca6ca5d47e - added two pairs of ciphers to server preference (thx Dilian) 2015-03-17 22:02:23 +01:00
Dirk 2faad9de9a - working tls handshake with bash sockets (not yet in production, hint: see option "-q" in the bottom) 2015-03-17 18:11:18 +01:00
Dirk c159af7f42 - check whether openssl is executable 
- spaces to tabs
- adding hint to "aha" in help
 2015-03-17 15:14:58 +01:00
Dirk 263535520f - FIX for date --> applied to other BSD systems too 
- FIX for SNI output as it doensn';t make sense for non HTTP servives
- lines for RC4 and PFS shortenedA
- display all MX records to test before testing
- removed LOCERR, added CCS_MAX_WAITSOCK, HEARTBLEED_MAX_WAITSOCK
 2015-03-17 12:22:21 +01:00
Dirk f8ba69f9fb - some internal code internal cleanups 
- minor cosmetic output corrections
- preparation for bash sockets for SSLv3 to TLS 1.2
 2015-03-16 00:22:51 +01:00
Dirk 4556108a72 further improvements through shellcheck 2015-03-15 16:59:29 +01:00
Dirk 68695bbad3 FIX #74 for sed BSD: doesn't like inline \n 
headline for BEAST was missing
 2015-03-15 16:10:14 +01:00
Dirk 655944bd4d - FIX: regression for wc -l w/o cat (3x) 
- removal of unneccessary waitpid, inline
 2015-03-15 14:41:34 +01:00
Dirk fbd383f345 - prework for checking hpkp fingerprints 2015-03-15 10:18:37 +01:00
Dirk 5cd4b8f73e - Shellcheck static analysis by Mark 2015-03-15 09:04:49 +01:00
Dirk Wetter bf411d8c11 Merge pull request #73 from feld/master 
Shellcheck static analysis
 2015-03-15 08:56:01 +01:00
Dirk b5a568da62 - @feld 2015-03-13 12:21:06 +01:00
Dirk c1ca5a641b - FIX garbled output for servers with a TLS reply on SSLv2 socket call 2015-03-13 12:20:19 +01:00
Dirk Wetter 74d984cebc Merge pull request #72 from feld/feld 
Minor optimizations to reduce unnecessary forking
 2015-03-13 11:00:52 +01:00
Dirk d8d8318f6d FIX for #71 (proper workaround for lastpipe in rc4, pfs, and cbc) 2015-03-09 08:07:45 +01:00
Dirk 77e28922c1 - NEW: proper check for freak CVE-2015-0204 
- NEW: check for number of keys for hpkp
- cleanup hsts+hpkp
 2015-03-07 09:51:55 +01:00
Dirk f23904b35f - MX record: the lower the # the higher the priority (thx, rechi) 2015-03-03 07:21:30 +01:00
Dirk 77ed44207c - see #41 2015-03-02 14:44:02 +01:00
Dirk 55e8908234 - finalize mx records, FIX: #41 2015-03-02 14:42:28 +01:00
Dirk Wetter 2614c093d7 Merge pull request #66 from Rechi/master 
Check MX Records (#41)
 2015-03-02 14:13:33 +01:00
Dirk 37fa44cecf - remark about rc4 rfc 2015-03-02 14:09:34 +01:00