This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "O-Saft"
From OWASP
(Previous Releases tab added) |
(old downoads moved to previous releases tab) |
||
| Line 145: | Line 145: | ||
== Quick Download == | == Quick Download == | ||
* '''Stable Release (17.05.17)''': <u>[https://github.com/OWASP/O-Saft/archive/17.05.17.tar.gz o-saft.tgz]</u> | * '''Stable Release (17.05.17)''': <u>[https://github.com/OWASP/O-Saft/archive/17.05.17.tar.gz o-saft.tgz]</u> | ||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
* Test Version: <u>[https://github.com/OWASP/O-Saft/archive/master.zip master.zip]</u> (September 2016) | * Test Version: <u>[https://github.com/OWASP/O-Saft/archive/master.zip master.zip]</u> (September 2016) | ||
| Line 264: | Line 258: | ||
--> | --> | ||
=Previous Releases= | =Previous Releases= | ||
| − | + | == Download == | |
| + | * Stable Release (17.04.17): <u>[https://github.com/OWASP/O-Saft/archive/17.04.17.tar.gz o-saft.tgz]</u> | ||
| + | * Stable Release (17.03.17): <u>[https://github.com/OWASP/O-Saft/archive/17.03.17.tar.gz o-saft.tgz]</u> | ||
| + | * Stable Release (16.12.16): <u>[https://github.com/OWASP/O-Saft/archive/16.12.16.tar.gz o-saft.tgz]</u> | ||
| + | * Stable Release (16.11.16): <u>[https://github.com/OWASP/O-Saft/archive/16.11.16.tar.gz o-saft.tgz]</u> | ||
| + | * Stable Release (16.09.16): <u>[https://github.com/OWASP/O-Saft/archive/16.09.16.tar.gz o-saft.tgz]</u> | ||
| + | * Stable Release (15.12.15): <u>[https://github.com/OWASP/O-Saft/archive/15.12.15.tar.gz o-saft.tgz]</u> | ||
__NOTOC__ <headertabs /> | __NOTOC__ <headertabs /> | ||
[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Tool]] [[Category:SSL]] [[Category:Test]] | [[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Tool]] [[Category:SSL]] [[Category:Test]] | ||
Revision as of 10:37, 11 June 2017
O-Saft - check for SSL connection, certificate and ciphers(this text to make crawlers happy;-)
O-Saft
O-Saft is an easy to use tool to show informations about SSL certificate and tests the SSL connection according given list of ciphers and various SSL configurations. It's designed to be used by penetration testers, security auditors or server administrators. The idea is to show the important informations or the special checks with a simple call of the tool. However, it provides a wide range of options so that it can be used for comprehensive and special checks by experienced people. O-Saft is a command-line tool, so it can be used offline and in closed environments. There is also a GUI based on Tcl/Tk. However, it can simply be turned into an online CGI-tool (please read documentation first). Introduction
DescriptionThe main idea is to have a tool which works on common platforms and can simply be automated.
New Features of Test Version
|
What is O-Saft?O-Saft provides:
Screen ShotsDocumentationPresentations
(These presentations are in German) Project LeaderAchim Hoffmann LicensingOWASP O-Saft is free to use. It is licensed under the GPL v2 license. Related ProjectsGithubOhloh |
Quick Download
News and Events
In Print / MediaFind a OWASP 24/7 podcast about the tool here. Classifications
| |||||||
- FAQs
- Where can I get missing Perl-Modules?
This depends on your OS and Perl installation, but just try cpan <Module-Name>, e.g. cpan Net:DNS
- I am connected to the internet via a Proxy
open the cpan-shell using 'cpan' and configure your proxy settings: 'o conf init /proxy/' - I can not download the requested files (the proxy needs authentication)
run 'cpan <Module-Name>' several times, read the error messages and copy the requested files manually to the paths (without any additional temporary extension of the name),
e.g. http://www.cpan.org/authors/01mailrc.txt.gz => <Your Program Path>/cpan/sources/authors/01mailrc.txt.gz
- I am connected to the internet via a Proxy
- I get the Error "invalid SSL_version specified at .../perl/vendor/lib/IO/Socket/SSL.pm line ..."
- add options --notlsv13 --nodtlsv1, e.g. perl o-saft.pl +info your.tld --notlsv13 --nodtlsv1
- use +cipherall to check the ciphers for all protocols
- My local SSL libraries do *not* support legacy Protocols like SSLv2, SSLv3 or legacy Ciphers
- use o-saft.pl for all protocols that are supported by your local computer
- use o-saft.pl +cipherall (or 'checkAllCiphers.pl') to get the ciphers for the missing protocols, or recompile 'Net::SSLeay' and/or openssl to support more protocols and ciphers, see Documentation INSTALLATION for details
- I can not use the latest features of the test (experimental) version
- Please verify that you downloaded and unpacked the 'master.zip'-Archive
- some new functions are protected by the option --experimental, please add it to your command (and take care what happens)
- o-saft.pl seems to hang
- try one or all of following options (see Documentation Performance Problems);
- --no-dns -no-http --no-cert --no-sni --no-openssl
- Acknowledgements
Volunteers
O-Saft is developed by from the contributions of OWASP members. The primary contributors to date have been:
Repository
O-Saft's source code can be found at https://github.com/OWASP/O-Saft .
The latest stable tarball is https://github.com/OWASP/O-Saft/raw/master/o-saft.tgz
- Road Map
https://www.owasp.org/index.php/Projects/O-Saft/Roadmap
- Involvement in the development and promotion of O-Saft is actively encouraged!
You do not have to be a security expert in order to contribute. Contacts:
- mailto: Achim at owasp dot org
- Mailinglist
Some of the ways you can help:
- Quality assurance: simply test O-Saft and report defects and strange responses of servers
- Give some ideas how to implement scoring
- Need help in implementing
- authentication for proxies (BASIC, NTLM)
- check for more SSL/TLS-Extensions (including obsolete ones)
- check for more vulnerabilities
- check the full certificate chain
Download
- Stable Release (17.04.17): o-saft.tgz
- Stable Release (17.03.17): o-saft.tgz
- Stable Release (16.12.16): o-saft.tgz
- Stable Release (16.11.16): o-saft.tgz
- Stable Release (16.09.16): o-saft.tgz
- Stable Release (15.12.15): o-saft.tgz
