yawast 0.5.1 → 0.5.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 539f306ec70cc938d88b44ec0707c6ec1ca0aca7
-  data.tar.gz: 803509a1c451f01a0ccc9ee5f02fb27b98026468
+  metadata.gz: 7b364a28ae5689b6ec07c5f7f9bcf3475fc11144
+  data.tar.gz: 4d49cb9633e87e6f31fcb1e77c4177b73370a772
 SHA512:
-  metadata.gz: ceb2b182c49fb52f54a9b2d968d6cffa83ddcdc9f81cb295217cdb1fb1bc3c28a9b895017e71df16095f7fe4e9e054a96995714e526d01842c2a5914da62124a
-  data.tar.gz: 2461d0a00e1e58b7f1ba9a245778464265d162fb388c2acb965bb1e3d9c99e96f032f7c4843231cf082b155ab9eb335c14e24fa4b5f7d68d677dbe6c0fd9032d
+  metadata.gz: 56ea8e0165b2b634c24f8e4382099a0aa02fd5f57b1b4981994ea7885243d857fea28783ecdbe853701ab607169143f042c4d7cc8566de41a8c79dc05fef6264
+  data.tar.gz: 815079863ff0369a7fece526423a3e047ef814555488735f937048c6ca91a1a00e228336a70f0008fc533391daa5d407a95e39c941d2bf0a62cde2ffc2c864a6

data/CHANGELOG.md

@@ -1,3 +1,9 @@
+## 0.5.2 - 2017-07-13
+
+* [#107](https://github.com/adamcaudill/yawast/issues/107) - Current version check
+* [#111](https://github.com/adamcaudill/yawast/issues/111) - Display cipher suite used when running the SWEET32 test
+* [#110](https://github.com/adamcaudill/yawast/issues/110) - Bug: SWEET32 test doesn't properly force 3DES suites
+
 ## 0.5.1 - 2017-06-26
 
 * [#106](https://github.com/adamcaudill/yawast/issues/106) - Bug: SWEET32: Incorrect Request Count

data/lib/scanner/plugins/ssl/sweet32.rb

@@ -26,6 +26,7 @@ module Yawast
 
               #force 3DES - this is to ensure that 3DES specific limits are caught
               req.ciphers = ['3DES']
+              cipher = nil
 
               #attempt to find a version that supports 3DES
               versions = OpenSSL::SSL::SSLContext::METHODS.find_all { |v| !v.to_s.include?('_client') && !v.to_s.include?('_server')}
@@ -43,6 +44,8 @@ module Yawast
                         else
                           head = http.request_get(uri.path, headers)
                         end
+
+                        cipher = http.instance_variable_get(:@socket).io.cipher[0]
                       rescue
                         #check if we are using HEAD or GET. If we've already switched to GET, no need to do this again.
                         if use_head
@@ -59,13 +62,12 @@ module Yawast
                         if k.downcase == 'server'
                           if v == 'cloudflare-nginx'
                             puts 'Cloudflare server found: SWEET32 mitigated: https://support.cloudflare.com/hc/en-us/articles/231510928'
-                            return
                           end
                         end
                       end
                     end
 
-                    print "Using #{version}"
+                    print "Using #{version} (#{cipher})"
                     break
                   rescue
                     #we don't care
@@ -78,6 +80,8 @@ module Yawast
               req.use_ssl = uri.scheme == 'https'
               req.keep_alive_timeout = 600
 
+              req.ciphers = [*cipher]
+
               req.start do |http|
                 #cache the number of hits
                 10000.times do |i|
@@ -102,7 +106,7 @@ module Yawast
             rescue => e
               puts
 
-              if e.message.include? 'alert handshake failure'
+              if e.message.include?('alert handshake failure') || e.message.include?('no cipher match')
                 Yawast::Utilities.puts_info 'TLS Session Request Limit: Server does not support 3DES cipher suites'
               else
                 Yawast::Utilities.puts_info "TLS Session Request Limit: Connection terminated after #{count} requests (#{e.message})"

data/lib/scanner/ssl.rb

@@ -92,7 +92,7 @@ module Yawast
       def self.get_cert_chain_info(cert_chain, cert)
         if cert_chain.count == 1
           #HACK: This is an ugly way to guess if it's a missing intermediate, or self-signed
-          #tIt looks like a change to Ruby's OpenSSL wrapper is needed to actually fix this right.
+          #It looks like a change to Ruby's OpenSSL wrapper is needed to actually fix this right.
 
           if cert.issuer == cert.subject
             Yawast::Utilities.puts_vuln "\t\tCertificate Is Self-Singed"

data/lib/version.rb

@@ -1,3 +1,3 @@
 module Yawast
-  VERSION = '0.5.1'
+  VERSION = '0.5.2'
 end

data/lib/yawast.rb

@@ -12,6 +12,7 @@ require 'uri'
 require 'resolv'
 require 'net/http'
 require 'socket'
+require 'colorize'
 
 require File.dirname(__FILE__) + '/string_ext'
 require File.dirname(__FILE__) + '/uri_ext'
@@ -38,6 +39,17 @@ module Yawast
     puts ' Copyright (c) 2013-2017 Adam Caudill <adam@adamcaudill.com>'
     puts ' Support & Documentation: https://github.com/adamcaudill/yawast'
     puts " Ruby #{RUBY_VERSION}-p#{RUBY_PATCHLEVEL}; #{OpenSSL::OPENSSL_VERSION} (#{RUBY_PLATFORM})"
+
+    begin
+      version = JSON.parse(Net::HTTP.get(URI('https://rubygems.org/api/v1/versions/yawast/latest.json')))['version']
+
+      if version != VERSION
+        puts " Latest Version: YAWAST v#{version} is the officially supported version, please update.".blue
+      end
+    rescue
+      #we don't care, this is a best effort check
+    end
+
     puts ''
   end
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: yawast
 version: !ruby/object:Gem::Version
-  version: 0.5.1
+  version: 0.5.2
 platform: ruby
 authors:
 - Adam Caudill
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2017-06-26 00:00:00.000000000 Z
+date: 2017-07-13 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: ssllabs