This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

Difference between revisions of "O-Saft"

From OWASP
Jump to: navigation, search
(→‎FAQs)
Line 109: Line 109:
  
 
=FAQs=
 
=FAQs=
−
;FAQs: <!-- workaround bug in headertabs-->
+
;FAQs <!-- workaround bug in headertabs-->
 
: (not yet available)
 
: (not yet available)
  
 
= Acknowledgements =
 
= Acknowledgements =
 +
;Acknowledgements <!-- workaround bug in headertabs-->
 
==Volunteers==
 
==Volunteers==
 
O-Saft is developed by <!--a worldwide team of volunteers--> from the contributions of OWASP members. The primary contributors to date have been:
 
O-Saft is developed by <!--a worldwide team of volunteers--> from the contributions of OWASP members. The primary contributors to date have been:
Line 122: Line 123:
  
 
= Road Map and Getting Involved =
 
= Road Map and Getting Involved =
−
;Road Map
+
;Road Map <!-- workaround bug in headertabs-->
 
https://www.owasp.org/index.php/Projects/O-Saft/Roadmap
 
https://www.owasp.org/index.php/Projects/O-Saft/Roadmap
  
Line 131: Line 132:
 
* [https://www.owasp.org/index.php/Projects/O-Saft/Roadmap Mailinglist]
 
* [https://www.owasp.org/index.php/Projects/O-Saft/Roadmap Mailinglist]
  
 +
<!-- don't include legacy project template, just for information here
 
=Project About=
 
=Project About=
−
{{:Projects/O-Saft}}}
+
{{:Projects/O-Saft}}}  
 +
-->
  
 
__NOTOC__ <headertabs />  
 
__NOTOC__ <headertabs />  
  
 
[[Category:OWASP Project]]  [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]]  [[Category:OWASP_Document]]
 
[[Category:OWASP Project]]  [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]]  [[Category:OWASP_Document]]

Revision as of 00:07, 30 January 2014

OWASP Project Header.jpg

O-Saft

OWASP SSL audit for testers / OWASP SSL advanced forensic tool

O-Saft is an easy to use tool to show informations about SSL certificate and tests the SSL connection according given list of ciphers and various SSL configurations.

It's designed to be used by penetration testers, security auditors or server administrators. The idea is to show the important informations or the special checks with a simple call of the tool. However, it provides a wide range of options so that it can be used for comprehensive and special checks by experienced people.

Introduction

Quick Installation
  • Download and unpack o-saft.tgz
  • Ensure that following perl modules (and their dependencies) are installed
      IO::Socket::INET, IO::Socket::SSL, Net::SSLeay
      Net::SSLinfo (which is part of the tarball)
  • read and (re-)move o-saft-README
  • Show help
o-saft --help=commands
o-saft --help
  • Start
o-saft +info your.tld
o-saft +check your.tld
o-saft +quick your.tld

Description

The main idea is to have a tool which works on common platforms and can simply be automated.

In a Nutshell
  • show SSL connection details
  • show certificate details
  • check for supported ciphers
  • check for ciphers provided in your own libssl.so and libcrypt.so
  • check for special HTTP(S) support (like SNI, HSTS, certificate pinning)
  • check for protections against attacks (BEAST, CRIME, RC4 Bias, ...)
  • may check for a single attribute
  • may check multiple targets at once
  • can be scripted (headless or as CGI)
  • should work on any platform (just needs perl, openssl optional)
  • scoring for all checks (still to be improved in many ways ;-)
  • output format can be customized
  • various trace and debug options to hunt unusual connection problems

What is O-Saft?

O-Saft provides:

  • SSL connection details
  • certificate details
  • full cipher check
  • special HTTP(s) checks
  • check for SSL vulnerabilities
  • can be scripted
  • platfrom independent
  • customizable output

Presentation

Vortrag beim Münchner OWASP-Stammtisch: Überblick über aktuelle Angriffsmöglichkeiten auf HTTPS / SSL (enthält auch ein paar Beispiele mit o-saft) (this presentation is in German)

Project Leader

Achim Hoffmann

Licensing

OWASP O-Saft is free to use. It is licensed under the GPL v2 license.

Related Projects

Quick Download


News and Events

  • Latest stable release
01/2014, O-Saft 14.1.4

In Print

Classifications

Owasp-incubator-trans-85.png Owasp-builders-small.png
Owasp-defenders-small.png
Cc-button-y-sa-small.png
Project Type Files TOOL.jpg
FAQs
(not yet available)
Acknowledgements

Volunteers

O-Saft is developed by from the contributions of OWASP members. The primary contributors to date have been:

Repository

O-Saft's source code can be found at https://github.com/OWASP/O-Saft .

The latest stable tarball is https://github.com/OWASP/O-Saft/raw/master/o-saft.tgz

Road Map

https://www.owasp.org/index.php/Projects/O-Saft/Roadmap

Involvement in the development and promotion of O-Saft is actively encouraged!

You do not have to be a security expert in order to contribute. Contacts:


Retrieved from "https://wiki.owasp.org/index.php?title=O-Saft&oldid=166899"