This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "O-Saft"
From OWASP
(Added a hint about the GUI based on Tcl/Tk in the Abstract) |
(15.12.2015 Stable Release '''15.12.15''') |
||
| Line 60: | Line 60: | ||
:* check for special HTTP(S) support (like SNI, HSTS, certificate pinning) | :* check for special HTTP(S) support (like SNI, HSTS, certificate pinning) | ||
:* check for protections against attacks (BEAST, CRIME, FREAK, Heartbleed, Lucky 13, POODLE, RC4 Bias, ...) | :* check for protections against attacks (BEAST, CRIME, FREAK, Heartbleed, Lucky 13, POODLE, RC4 Bias, ...) | ||
| + | :* check the len of Diffie Hellman Parameters by the cipher (+cipherall needs option '--experimental') | ||
:* may check for a single attribute | :* may check for a single attribute | ||
:* may check multiple targets at once | :* may check multiple targets at once | ||
| Line 77: | Line 78: | ||
* Start ''INSTALL-devel.sh'' | * Start ''INSTALL-devel.sh'' | ||
* Enjoy new functionality: | * Enjoy new functionality: | ||
| − | :* | + | :* In Improvement: |
| − | :* checkAllCiphers.pl/+cipherall: check the len of dh_parameter for ciphers with DHE and DH_anon (independant from openssl, '--experimental' needed) | + | ::* checkAllCiphers.pl/+cipherall: check the len of dh_parameter for ciphers with DHE and DH_anon (independant from openssl, '--experimental' needed) |
| − | :* checkAllCiphers.pl/+cipherall: support now fagmented messages reassembling SSL/TLS-records ('--experimental') | + | ::* checkAllCiphers.pl/+cipherall: support now fagmented messages reassembling SSL/TLS-records ('--experimental') |
* please give us feedback via the [https://lists.owasp.org/mailman/listinfo/o-saft mailinglist] | * please give us feedback via the [https://lists.owasp.org/mailman/listinfo/o-saft mailinglist] | ||
| Line 131: | Line 132: | ||
== Quick Download == | == Quick Download == | ||
| − | * Stable Release (15. | + | * Stable Release (15.12.15): <u>[https://github.com/OWASP/O-Saft/raw/master/o-saft.tgz o-saft.tgz]</u> |
* Test Version: <u>[https://github.com/OWASP/O-Saft/archive/master.zip master.zip]</u> | * Test Version: <u>[https://github.com/OWASP/O-Saft/archive/master.zip master.zip]</u> | ||
| Line 141: | Line 142: | ||
http://appseceurope2014.sched.org/event/0e316b9ea5c28375dcc8fd41baedd481 | http://appseceurope2014.sched.org/event/0e316b9ea5c28375dcc8fd41baedd481 | ||
--> | --> | ||
| + | * 15.12.2015 Stable Release '''15.12.15''' | ||
| + | * 15.11.2015 Stable Release '''15.11.15''' | ||
* 05.04.2015, '''simple GUI''' available <u>[https://github.com/OWASP/O-Saft/blob/master/o-saft.tcl o-saft.tcl]</u> | * 05.04.2015, '''simple GUI''' available <u>[https://github.com/OWASP/O-Saft/blob/master/o-saft.tcl o-saft.tcl]</u> | ||
* 08.01.2015, stable release '''15.01.07''' | * 08.01.2015, stable release '''15.01.07''' | ||
Revision as of 18:50, 18 December 2015
O-Saft - check for SSL connection, certificate and ciphers(this text to make crawlers happy;-)
O-Saft
O-Saft is an easy to use tool to show informations about SSL certificate and tests the SSL connection according given list of ciphers and various SSL configurations. It's designed to be used by penetration testers, security auditors or server administrators. The idea is to show the important informations or the special checks with a simple call of the tool. However, it provides a wide range of options so that it can be used for comprehensive and special checks by experienced people. O-Saft is a command-line tool, so it can be used offline and in closed environments. There is also a GUI based on Tcl/Tk. However, it can simply be turned into an online CGI-tool (please read documentation first). Introduction
DescriptionThe main idea is to have a tool which works on common platforms and can simply be automated.
New Features of Test Version
|
What is O-Saft?O-Saft provides:
DocumentationPresentations
(These presentations are in German) Project LeaderAchim Hoffmann LicensingOWASP O-Saft is free to use. It is licensed under the GPL v2 license. Related ProjectsGithubOhloh |
Quick Download
News and Events
In Print / MediaFind a OWASP 24/7 podcast about the tool here. Classifications
| |||||||
- FAQs
- Where can I get missing Perl-Modules?
This depends on your OS and Perl installation, but just try 'cpan <Module-Name>', e.g. 'cpan Net:DNS'
- I am connected to the internet via a Proxy
open the cpan-shell using 'cpan' and configure your proxy settings: 'o conf init /proxy/' - I can not download the requested files (the proxy needs authentication)
run 'cpan <Module-Name>' several times, read the error messages and copy the requested files manually to the paths (without any additional temporary extension of the name),
e.g. http://www.cpan.org/authors/01mailrc.txt.gz => <Your Program Path>/cpan/sources/authors/01mailrc.txt.gz
- I am connected to the internet via a Proxy
- I get the Error "invalid SSL_version specified at .../perl/vendor/lib/IO/Socket/SSL.pm line ..."
- add options '--notlsv13 --nodtlsv1', e.g. perl o-saft.pl +info your.tld --notlsv13 --nodtlsv1
- Acknowledgements
Volunteers
O-Saft is developed by from the contributions of OWASP members. The primary contributors to date have been:
Repository
O-Saft's source code can be found at https://github.com/OWASP/O-Saft .
The latest stable tarball is https://github.com/OWASP/O-Saft/raw/master/o-saft.tgz
- Road Map
https://www.owasp.org/index.php/Projects/O-Saft/Roadmap
- Involvement in the development and promotion of O-Saft is actively encouraged!
You do not have to be a security expert in order to contribute. Contacts:
- mailto: Achim at owasp dot org
- Mailinglist
Some of the ways you can help:
- Quality assurance: simply test O-Saft and report defects and strange responses of servers
- Give some ideas how to implement scoring
- Need help in implementing
- authentication for proxies (BASIC, NTLM)
- to check the size of Diffie Hellmann Parameters
- check for more SSL/TLS-Extensions (including obsolete ones)
- check for more vulnerabilities
- check the full certificate chain
