08fe890d5f
- two fixes from #40 reported by @salt-lick
Dirk2015-05-11 08:52:40 +02:00
19fc021587
- FIX: 30x with BigIP doesn't have a date, handled properly now - generic GET/HEAD is now always with URL_PATH
Dirk2015-05-10 23:38:06 +02:00
2f79ba52fc
- NUMEROUS FreeBSD9/Darwin FIXES#40 - http date - cipher list in preferences - GET_REQ11 now closes the connection - openssl_age comes afeter the banner so that help doesn't need to go thru this - uname -s ==> SYSTEM
Dirk2015-05-10 19:20:55 +02:00
0aa8ac7e76
- more robust wrt IIS6 (some stuff better with IIS7) - X-Powered-By is easy to remove (PHP, ASP.NET), thus labelled as yellow - same X-AspNet-Version (version # itself is brown) - better addressed address resolution failures ;-) - bumped up version to 2.4rc1
Dirk2015-05-06 18:48:51 +02:00
f3f3967bd1
- FIX $87 (2), finally - feature: integrated TLS+HTTP time into server defaults - NEW: option: -U/vulnerable - moved explanation for BREACH into result - FREAK and CCS are not labled experimental anymore - unifying of get request headers - readability of help
Dirk2015-05-02 15:01:02 +02:00
2aa82e5164
- partly FIX for #87 (removed SNI helps. Doesn't make sense anyway) - changed order of Secure Renegotiation/Secure Client-Initiated Renegotiation - readability improvements in renego
Dirk Wetter2015-05-01 12:18:43 +02:00
d766a0b459
- fix additional \n in RC4 if no RC4 ciphers were detected
Dirk2015-04-28 08:04:09 +02:00
1ea7a0947f
- RC4 has now 2 CVEs and cipher per default are displayed short - introducng a variable name LONG which for certain funcs shows broad output with hexc, cipher, KX, etc. - FIX: regression not showing security headers - introducing VULN_THRESHLD
Dirk2015-04-22 18:24:39 +02:00
3891f5b13b
- FIX#83 - emphasize also OS names in HTTP headers
Dirk2015-04-22 15:22:53 +02:00
06bd8b2517
- FIX for complete bailing out
Dirk2015-04-22 11:56:13 +02:00
bafce6edce
- reordering code so that all attacks are together - RC4 is now really omitted in PFS test - cleanup of some comments
Dirk2015-04-22 10:33:44 +02:00
5bec0a16c9
- better compatibility with windows 2003 server - all long options are advertised now as with dashes and not underscore - cosmetic stuff
Dirk2015-04-20 10:05:01 +02:00
5625ee536e
- BUGFIX: IIS server lead to false pisitive if SSLv3 was enabled (timeout was faster then socket resply) - FIX: CORS header not labeled as green - NEW: Now also STARTTLS works with all cmd line options and is absolutely doing the same stuff! (integrated starttls() into parse_hn_port() ) - option --mx needed to be changed because of starttls - regression fix: exec for socket doesn't play nice with stderr redirect (probably bash bug) - added some env options to cmd line as long args (--assuming-http,--ssl_native, --color, debug, --sneaky, --warnings) - threw away getent as it doesn't work under Linux && not network && localhost (replaced by grep) - SSL-POODLE is not labeled anymore experimental - HB+CCS are called while checking STARTTLS but given a hint that its not yet supported - added more env vars to debug output - cleanups
Dirk2015-04-16 20:36:17 +02:00
f682c5ceea
- FIX regression: more_flags execution was missing - FIX regression: capitalized/all lowercase headers weren't detected - if socksend is blocked (IDS) output looks better and is reported as test didn't succeed - no secure cookie or Httponly will be marked as brown - tput color yellow is now brown
Dirk2015-04-14 13:16:43 +02:00
9d5168dbb5
- more robust grep >=2.20, e.g Debian 8.0 (thx @stevenb18) - FIX: false positive for breach while testing google.com (referer header was hardcoded to google.com)
Dirk2015-04-14 10:15:07 +02:00
683e9dccab
- FIX (regression): -V - logic of some ENV variables changed (attention!) - included some ENV as long options (not in the help yet) - decentralized http check for breach - if openssl is not executable it bails out better now - help function now exits
Dirk2015-04-13 22:55:40 +02:00
1043c40a60
Merge branch 'master' of github.com:drwetter/testssl.sh
Dirk2015-04-10 15:16:20 +02:00
a12d39769f
- underline CN, SAN and issuer deutschepost case (see sourceforge.net/p/ssllabs/mailman/message/33764851/)
Dirk2015-04-10 15:15:47 +02:00
8da96f78f2
- got rid of "strings"
Dirk2015-04-02 12:19:24 +02:00
4bbd19ba03
- updated binaries from Peter. Necessary because handshake under rare circumstances failed (routines:tls1_setup_key_block:cipher or hash unavailable:t1_enc.c:802. SLES 12 server, some ciphers under TLS 1.2
Dirk2015-04-02 11:46:12 +02:00
940f51e74b
protocol check via sockets now also for SSLv3
Dirk2015-03-31 10:34:30 +02:00
9ed58b6202
cleanups / bsd date in tls time
Dirk2015-03-30 23:09:19 +02:00
ca6ca5d47e
- added two pairs of ciphers to server preference (thx Dilian)
Dirk2015-03-17 22:02:23 +01:00
2faad9de9a
- working tls handshake with bash sockets (not yet in production, hint: see option "-q" in the bottom)
Dirk2015-03-17 18:11:18 +01:00
c159af7f42
- check whether openssl is executable - spaces to tabs - adding hint to "aha" in help
Dirk2015-03-17 15:14:58 +01:00
263535520f
- FIX for date --> applied to other BSD systems too - FIX for SNI output as it doensn';t make sense for non HTTP servives - lines for RC4 and PFS shortenedA - display all MX records to test before testing - removed LOCERR, added CCS_MAX_WAITSOCK, HEARTBLEED_MAX_WAITSOCK
Dirk2015-03-17 12:22:21 +01:00
f8ba69f9fb
- some internal code internal cleanups - minor cosmetic output corrections - preparation for bash sockets for SSLv3 to TLS 1.2
Dirk2015-03-16 00:22:51 +01:00
4556108a72
further improvements through shellcheck
Dirk2015-03-15 16:59:29 +01:00
68695bbad3FIX#74 for sed BSD: doesn't like inline \n headline for BEAST was missing
Dirk2015-03-15 16:10:14 +01:00
655944bd4d
- FIX: regression for wc -l w/o cat (3x) - removal of unneccessary waitpid, inline
Dirk2015-03-15 14:41:34 +01:00
fbd383f345
- prework for checking hpkp fingerprints
Dirk2015-03-15 10:18:37 +01:00
5cd4b8f73e
- Shellcheck static analysis by Mark
Dirk2015-03-15 09:04:49 +01:00
8aa8254c2d
- FIX#62 (CentOS 7/RHEL: engine failure), was not usable b4
Dirk2015-02-23 10:40:10 +01:00
d0d7bb47e2
- FIXED: #47 ("double" linefeed if RFC mapping file is not present)
Dirk2015-02-22 23:05:40 +01:00
e2448ea95d
- NEW: tells how many certificates provides (and grabs them with DEBUG=1) - COLOR for no cipher order is red now - "VULNERABLE" comes now always with "NOT ok"
Dirk2015-02-21 11:47:12 +01:00
1be281c404
- FIXED: #38, new openssl from Peter Mosmans makes the workaround unneccessary
Dirk2015-02-21 10:46:30 +01:00
a255462812
- to tell the difference between the sets of binaries
Dirk2015-02-21 10:39:27 +01:00
bacb3b69ba
- FIXED: #38, new openssl from peter mosmans makes the workaround unneccessary
Dirk2015-02-21 10:38:04 +01:00
b261c1079a
- Fix#55 (302 detection for URL)
Dirk2015-02-15 14:00:13 +01:00
f203b8b299
- Fix#46 (preload lists HPKP and HSTS) - word match for includeSubDomains (useful if one specified the keyword wrong)
Dirk2015-02-15 13:37:44 +01:00
Dirk
Peter Mosmans
Mark Felder
Mark Felder
Rechi
Marc Schütz