Testing for SSL-TLS (OWASP-CM-001) - Revision history

Tony Hsu HsiangChih: /* References */

2017-02-07T09:21:38Z

‎References

Calderpwn: Adds nmap as a tool

2016-08-16T04:58:26Z

Adds nmap as a tool

Achim: /* References */

2016-02-22T08:33:15Z

‎References

Achim: Undo revision 209353 by Achim (talk)

2016-02-22T08:32:10Z

Undo revision 209353 by Achim (talk)

Achim: /* References */ syntax corrected

2016-02-22T08:31:06Z

‎References: syntax corrected

Achim: /* References */ wiki syntax for internal links

2016-02-22T08:29:46Z

‎References: wiki syntax for internal links

Achim: /* References */ O-Saft added

2016-02-22T08:26:58Z

‎References: O-Saft added

ADHTB: /* References */

2015-11-19T10:55:22Z

‎References

Dirk Wetter at 10:36, 12 April 2013

2013-04-12T10:36:29Z

Jeffrey Walton: Broke RSA and DSA key sizes out into separate entries

2013-03-10T05:46:03Z

Broke RSA and DSA key sizes out into separate entries

@@ Line 400: / Line 400: @@
 * [3] RFC3546. Transport Layer Security (TLS) Extensions - http://www.ietf.org/rfc/rfc3546.txt
 * [4] <u>www.verisign.net</u> features various material on the topic
+* https://github.com/ssllabs/research/wiki
 '''Tools'''

← Older revision		Revision as of 04:58, 16 August 2016
Line 422:		Line 422:

	* O-Saft [[O-Saft \| https://www.owasp.org/index.php/O-Saft]] can test for '''any''' cipher, independent of the underlaying SSL library (such as OpenSSL).		* O-Saft [[O-Saft \| https://www.owasp.org/index.php/O-Saft]] can test for '''any''' cipher, independent of the underlaying SSL library (such as OpenSSL).
		+
		+	* Nmap includes NSE scripts to test for SSLv2 (https://nmap.org/nsedoc/scripts/sslv2.html) and enumerating SSLv3/TLS ciphers (https://nmap.org/nsedoc/scripts/ssl-enum-ciphers.html). Additionally it can also detect Diffie-Hellman weaknesses (https://nmap.org/nsedoc/scripts/ssl-dh-params.html), Poodle (https://nmap.org/nsedoc/scripts/ssl-poodle.html) and even Heartbleed (https://nmap.org/nsedoc/scripts/ssl-heartbleed.html)

	* Finally, a word of advice. Though it may be tempting to use a regular browser to check certificates, there are various reasons for not doing so. Browsers have been plagued by various bugs in this area, and the way the browser will perform the check might be influenced by configuration settings that may not be evident. Instead, rely on vulnerability scanners or on specialized tools to do the job.		* Finally, a word of advice. Though it may be tempting to use a regular browser to check certificates, there are various reasons for not doing so. Browsers have been plagued by various bugs in this area, and the way the browser will perform the check might be influenced by configuration settings that may not be evident. Instead, rely on vulnerability scanners or on specialized tools to do the job.

@@ Line 425: / Line 425: @@
 * Finally, a word of advice. Though it may be tempting to use a regular browser to check certificates, there are various reasons for not doing so. Browsers have been plagued by various bugs in this area, and the way the browser will perform the check might be influenced by configuration settings that may not be evident. Instead, rely on vulnerability scanners or on specialized tools to do the job.
-* [Transport_Layer_Protection_Cheat_Sheet OWASP Transport Layer Protection Cheat Sheet]
+* [[Transport_Layer_Protection_Cheat_Sheet | OWASP Transport Layer Protection Cheat Sheet]]
 * [https://www.htbridge.com/ssl/ High-Tech Bridge] - Online tool to verify SSL/TLS compliance with NIST SP 800-52 guidelines and PCI DSS requirements on any TCP port.

@@ Line 425: / Line 425: @@
 * Finally, a word of advice. Though it may be tempting to use a regular browser to check certificates, there are various reasons for not doing so. Browsers have been plagued by various bugs in this area, and the way the browser will perform the check might be influenced by configuration settings that may not be evident. Instead, rely on vulnerability scanners or on specialized tools to do the job.
-* [[Transport_Layer_Protection_Cheat_Sheet OWASP Transport Layer Protection Cheat Sheet]]
+* [Transport_Layer_Protection_Cheat_Sheet OWASP Transport Layer Protection Cheat Sheet]
 * [https://www.htbridge.com/ssl/ High-Tech Bridge] - Online tool to verify SSL/TLS compliance with NIST SP 800-52 guidelines and PCI DSS requirements on any TCP port.

@@ Line 425: / Line 425: @@
 * Finally, a word of advice. Though it may be tempting to use a regular browser to check certificates, there are various reasons for not doing so. Browsers have been plagued by various bugs in this area, and the way the browser will perform the check might be influenced by configuration settings that may not be evident. Instead, rely on vulnerability scanners or on specialized tools to do the job.
-* [Transport_Layer_Protection_Cheat_Sheet OWASP Transport Layer Protection Cheat Sheet]
+* [[Transport_Layer_Protection_Cheat_Sheet OWASP Transport Layer Protection Cheat Sheet]]
 * [https://www.htbridge.com/ssl/ High-Tech Bridge] - Online tool to verify SSL/TLS compliance with NIST SP 800-52 guidelines and PCI DSS requirements on any TCP port.

← Older revision		Revision as of 08:26, 22 February 2016
Line 420:		Line 420:

	* testssl.sh http://drwetter.eu/software/ssl/		* testssl.sh http://drwetter.eu/software/ssl/
		+
		+	* O-Saft [[O-Saft \| https://www.owasp.org/index.php/O-Saft]] can test for '''any''' cipher, independent of the underlaying SSL library (such as OpenSSL).

	* Finally, a word of advice. Though it may be tempting to use a regular browser to check certificates, there are various reasons for not doing so. Browsers have been plagued by various bugs in this area, and the way the browser will perform the check might be influenced by configuration settings that may not be evident. Instead, rely on vulnerability scanners or on specialized tools to do the job.		* Finally, a word of advice. Though it may be tempting to use a regular browser to check certificates, there are various reasons for not doing so. Browsers have been plagued by various bugs in this area, and the way the browser will perform the check might be influenced by configuration settings that may not be evident. Instead, rely on vulnerability scanners or on specialized tools to do the job.

@@ Line 424: / Line 424: @@
 * [http://www.owasp.org/index.php/Transport_Layer_Protection_Cheat_Sheet OWASP Transport Layer Protection Cheat Sheet]
 [[Category:Cryptographic Vulnerability]]
 [[Category:SSL]]

← Older revision		Revision as of 10:36, 12 April 2013
Line 418:		Line 418:

	* ssl_tests, http://www.pentesterscripting.com/discovery/ssl_tests		* ssl_tests, http://www.pentesterscripting.com/discovery/ssl_tests
		+
		+	* testssl.sh http://drwetter.eu/software/ssl/

	* Finally, a word of advice. Though it may be tempting to use a regular browser to check certificates, there are various reasons for not doing so. Browsers have been plagued by various bugs in this area, and the way the browser will perform the check might be influenced by configuration settings that may not be evident. Instead, rely on vulnerability scanners or on specialized tools to do the job.		* Finally, a word of advice. Though it may be tempting to use a regular browser to check certificates, there are various reasons for not doing so. Browsers have been plagued by various bugs in this area, and the way the browser will perform the check might be influenced by configuration settings that may not be evident. Instead, rely on vulnerability scanners or on specialized tools to do the job.

@@ Line 22: / Line 22: @@
 * Compression, due to known weaknesses in protocol design [http://www.ekoparty.org/2012/juliano-rizzo.php]
 * Cipher suites with symmetric encryption algorithm smaller than 112 bits
-* X.509 certificates with RSA or DSA key smaller than 2048 bits
+* X.509 certificates with RSA key smaller than 2048 bits
 * X.509 certificates signed using MD5 hash, due to known collision attacks on this hash
 * TLS Renegotiation vulnerability [http://www.phonefactor.com/sslgap/ssl-tls-authentication-patches]