yawast 0.6.0.beta3 → 0.6.0.beta4

Sign up to get free protection for your applications and to get access to all the features.
Files changed (21) hide show
  1. checksums.yaml +4 -4
  2. data/.codeclimate.yml +3 -12
  3. data/CHANGELOG.md +2 -0
  4. data/README.md +25 -524
  5. data/bin/yawast +0 -11
  6. data/lib/scanner/plugins/ssl/ssl_labs/analyze.rb +34 -0
  7. data/lib/scanner/plugins/ssl/ssl_labs/info.rb +33 -0
  8. data/lib/scanner/ssl_labs.rb +185 -163
  9. data/lib/shared/http.rb +5 -5
  10. data/lib/version.rb +1 -1
  11. data/test/data/ssl_labs_analyze_data.json +6458 -0
  12. data/test/data/ssl_labs_analyze_start.json +11 -0
  13. data/test/data/ssl_labs_info.json +10 -0
  14. data/test/test_internalssl.rb +2 -2
  15. data/test/test_shared_http.rb +1 -1
  16. data/test/test_ssl_labs_analyze.rb +48 -0
  17. data/test/test_ssl_labs_info.rb +20 -0
  18. data/yawast.gemspec +0 -1
  19. metadata +14 -18
  20. data/lib/commands/cert.rb +0 -10
  21. data/lib/scanner/cert.rb +0 -99
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA1:
3
- metadata.gz: 22035a8dee3ff0cb29da78d15ae0e664c3ec3246
4
- data.tar.gz: 02e2880f7d8569b17bc11d1b88481895dcd1b992
3
+ metadata.gz: 240eb319d357319184c61e26c0011a625af7d8ba
4
+ data.tar.gz: b0bcd8e815fc4eaa4d9573a90745d4e55289b542
5
5
  SHA512:
6
- metadata.gz: dab8b3cc377e7d2d8b5a33ceea9e0b62dc0e43d732c39fd4daaa32bd4f0a410057ba45a219a9fb65ea32a6cd91b0ea6be7d0cbb7db61fcb4f70b58f6c34d4bd1
7
- data.tar.gz: 32a6f3f8486aa9c9a597b1ad3d546a63def8ae650e0555e62e440c378b54c95c4bd09f0d891828f4d66ca10992274d74336fa684af765d34b7f1aa018a1cf657
6
+ metadata.gz: 3b78fbe31218ebfac9bd9b72f43f4662d890bd647f5e6797538b4125a7b041494d071205a7b4c822ba00573e065d349181650a034fd5fe31cba070e385c8773a
7
+ data.tar.gz: 6ae967a045c69c49f8eeeb71e1601574fde7e2ba8b81823f2d3ce5baedfa09f8efd9cc3564d217ea042cebbc1db9ac552608c90af2e90e4338153ca57d37efd6
data/.codeclimate.yml CHANGED
@@ -1,25 +1,16 @@
1
- ---
2
1
  engines:
3
2
  duplication:
4
3
  enabled: true
5
4
  config:
6
5
  languages:
7
- - ruby
8
- - javascript
9
- - python
10
- - php
6
+ ruby:
7
+ mass_threshold: 24
11
8
  fixme:
12
9
  enabled: true
13
10
  rubocop:
14
11
  enabled: true
15
12
  ratings:
16
13
  paths:
17
- - "**.inc"
18
- - "**.js"
19
- - "**.jsx"
20
- - "**.module"
21
- - "**.php"
22
- - "**.py"
23
14
  - "**.rb"
24
15
  exclude_paths:
25
- - test/
16
+ - test/
data/CHANGELOG.md CHANGED
@@ -1,6 +1,7 @@
1
1
  ## 0.6.0 - In Development
2
2
 
3
3
  * [#54](https://github.com/adamcaudill/yawast/issues/54) - Check for Python version in Server header
4
+ * [#59](https://github.com/adamcaudill/yawast/issues/59) - SSL Labs: Display Certificate Chain
4
5
  * [#109](https://github.com/adamcaudill/yawast/issues/109) - DNS CAA Support
5
6
  * [#113](https://github.com/adamcaudill/yawast/issues/113) - Better False Positive Detection For Directory Search
6
7
  * [#115](https://github.com/adamcaudill/yawast/issues/115) - Add dns Command
@@ -8,6 +9,7 @@
8
9
  * [#117](https://github.com/adamcaudill/yawast/issues/117) - Show additional information about the TLS connection
9
10
  * [#118](https://github.com/adamcaudill/yawast/issues/118) - Add check for CVE-2017-12617 - Apache Tomcat PUT RCE
10
11
  * [#120](https://github.com/adamcaudill/yawast/issues/120) - Add Docker support
12
+ * [#122](https://github.com/adamcaudill/yawast/issues/122) - SSL Labs API v3
11
13
 
12
14
  ## 0.5.2 - 2017-07-13
13
15
 
data/README.md CHANGED
@@ -1,4 +1,4 @@
1
- ## YAWAST [![Build Status](https://travis-ci.org/adamcaudill/yawast.svg?branch=master)](https://travis-ci.org/adamcaudill/yawast) [![Code Climate](https://codeclimate.com/github/adamcaudill/yawast/badges/gpa.svg)](https://codeclimate.com/github/adamcaudill/yawast) [![Test Coverage](https://codeclimate.com/github/adamcaudill/yawast/badges/coverage.svg)](https://codeclimate.com/github/adamcaudill/yawast/coverage) [![Gem Version](https://badge.fury.io/rb/yawast.svg)](https://badge.fury.io/rb/yawast)
1
+ ## YAWAST [![Build Status](https://travis-ci.org/adamcaudill/yawast.svg?branch=master)](https://travis-ci.org/adamcaudill/yawast) [![Code Climate](https://codeclimate.com/github/adamcaudill/yawast/badges/gpa.svg)](https://codeclimate.com/github/adamcaudill/yawast) [![Test Coverage](https://codeclimate.com/github/adamcaudill/yawast/badges/coverage.svg)](https://codeclimate.com/github/adamcaudill/yawast/coverage) [![Gem Version](https://badge.fury.io/rb/yawast.svg)](https://badge.fury.io/rb/yawast) [![Docker Build](https://img.shields.io/docker/automated/adamcaudill/yawast.svg)](https://hub.docker.com/r/adamcaudill/yawast/)
2
2
 
3
3
  **The YAWAST Antecedent Web Application Security Toolkit**
4
4
 
@@ -12,55 +12,19 @@ YAWAST is an application meant to simplify initial analysis and information gath
12
12
 
13
13
  This is meant to provide a easy way to perform initial analysis and information discovery. It's not a full testing suite, and it certainly isn't Metasploit. The idea is to provide a quick way to perform initial data collection, which can then be used to better target further tests. It is especially useful when used in conjunction with Burp Suite (via the `--proxy` parameter).
14
14
 
15
- ### Installing
16
-
17
- The simplest method to install is to use the RubyGem installer:
18
-
19
- `gem install yawast`
20
-
21
- This allows for simple updates (`gem update yawast`) and makes it easy to ensure that you are always using the latest version.
22
-
23
- YAWAST requires Ruby 2.2+, and is tested on Mac OSX, Linux, and Windows.
24
-
25
- #### Docker
26
-
27
- YAWAST can be run inside a docker container.
28
-
29
- ```
30
- docker pull adamcaudill/yawast && docker run --rm adamcaudill/yawast scan <url> ...
31
- ```
32
-
33
- This is the recommended option, especially if you need to perform the SWEET32 test (`--tdessessioncount`), due to OpenSSL dropping support for the 3DES cipher suites.
34
-
35
- #### Kali Rolling
36
-
37
- To install on Kali, just run `gem install yawast` - all of the dependencies are already installed. *Note:* The version of OpenSSL used with Kali doesn't support 3DES cipher suites, so some tests, such as SWEET32 do not work. If you need these tests to work, using the Docker image is the recommended solution.
38
-
39
- #### Ubuntu 16.04
15
+ Please see [the wiki](https://github.com/adamcaudill/yawast/wiki) for full documentation.
40
16
 
41
- To install YAWAST, you first need to install a couple packages via `apt-get`:
42
-
43
- ```
44
- sudo apt-get install ruby ruby-dev
45
- sudo gem install yawast
46
- ```
17
+ ### Installing
47
18
 
48
- #### Mac OSX
19
+ YAWAST is packaged as a Ruby Gem & Docker container to make installing it as easy as possible. Details are available [on the wiki](https://github.com/adamcaudill/yawast/wiki/Installation).
49
20
 
50
- The version of Ruby shipped with Mac OSX 10.11 is too old, so the recommended solution is to use RVM:
21
+ The simplest options to install are:
51
22
 
52
- ```
53
- gpg --keyserver hkp://keys.gnupg.net --recv-keys 409B6B1796C275462A1703113804BB82D39DC0E3
54
- \curl -sSL https://get.rvm.io | bash -s stable
55
- source ~/.rvm/scripts/rvm
56
- rvm install 2.4
57
- rvm use 2.4 --default
58
- gem install yawast
59
- ```
23
+ As a Gem: `gem install yawast`
60
24
 
61
- #### Windows
25
+ Via Docker: `docker pull adamcaudill/yawast`
62
26
 
63
- To install on Windows, you need to first install Ruby. This can be done easily with the latest version of [RubyInstaller](https://rubyinstaller.org/downloads/). Once Ruby is installed, YAWAST can be installed via `gem install yawast` as normal.
27
+ It's strongly recommended that you review the [installation](https://github.com/adamcaudill/yawast/wiki/Installation) documentation, to make sure you have the proper dependencies.
64
28
 
65
29
  ### Tests
66
30
 
@@ -85,8 +49,8 @@ The following tests are performed:
85
49
  * *(Generic)* Presence of WS_FTP.LOG
86
50
  * *(Generic)* Presence of RELEASE-NOTES.txt
87
51
  * *(Generic)* Presence of readme.html
88
- * *(Generic)* Missing cookie flags (Secure & HttpOnly)
89
- * *(Generic)* Search for files & common directories
52
+ * *(Generic)* Missing cookie flags (Secure, HttpOnly, and SameSite)
53
+ * *(Generic)* Search for files (14,011) & common directories (21,332)
90
54
  * *(Apache)* Info Disclosure: Module listing enabled
91
55
  * *(Apache)* Info Disclosure: Server version
92
56
  * *(Apache)* Info Disclosure: OpenSSL module version
@@ -129,494 +93,31 @@ Checks for the following SSL issues are performed:
129
93
  * Weak (< 128 bit) Cipher Suites
130
94
  * SWEET32
131
95
 
132
- In addition to these tests, certain basic information is also displayed, such as IPs (and the PTR record for each IP), HTTP HEAD request, and others.
133
-
134
- ### Usage
135
-
136
- * Standard scan: `yawast scan <url> [--internalssl] [--tdessessioncount] [--nossl] [--nociphers] [--dir] [--dirrecursive] [--dirlistredir] [--files] [--srv] [--subdomains] [--proxy localhost:8080] [--cookie SESSIONID=12345] [--nodns]`
137
- * HEAD-only scan: `yawast head <url> [--internalssl] [--tdessessioncount] [--nossl] [--nociphers] [--proxy localhost:8080] [--cookie SESSIONID=12345]`
138
- * SSL information: `yawast ssl <url> [--internalssl] [--tdessessioncount] [--nociphers]`
139
- * CMS detection: `yawast cms <url> [--proxy localhost:8080] [--cookie SESSIONID=12345]`
96
+ Certain DNS information is collected:
140
97
 
141
- For detailed information, just call `yawast -h` to see the help page. To see information for a specific command, call `yawast -h <command>` for full details. Here is an example, the details for the options to the `scan` command:
98
+ * IP Addresses
99
+ * IP Owner/Network (via [api.iptoasn.com](https://api.iptoasn.com/))
100
+ * TXT Records
101
+ * MX Records
102
+ * NS Records
103
+ * CAA Records (with CNAME chasing)
104
+ * Common Subdomains (2,354 subdomains) - optional, via `--subdomains`
105
+ * SRV Records - optional, via `--srv`
142
106
 
143
- ```
144
- OPTIONS:
145
-
146
- --nossl
147
- Disables SSL checks
148
-
149
- --nociphers
150
- Disables check for supported ciphers (only with --internalssl)
151
-
152
- --internalssl
153
- Disable SSL Labs integration
154
-
155
- --tdessessioncount
156
- Counts the number of messages that can be sent in a single session
157
-
158
- --dir
159
- Enables directory search
160
-
161
- --dirrecursive
162
- Recursive directory search (only with --dir)
163
-
164
- --dirlistredir
165
- Show 301 redirects (only with --dir)
166
-
167
- --files
168
- Performs a search for a large list of common files
169
-
170
- --srv
171
- Scan for known SRV DNS Records
172
-
173
- --subdomains
174
- Search for Common Subdomains
175
-
176
- --proxy STRING
177
- HTTP Proxy Server (such as Burp Suite)
178
-
179
- --cookie STRING
180
- Session cookie
181
-
182
- --nodns
183
- Disable DNS checks
184
- ```
185
-
186
- ### Using with Zap / Burp Suite
187
-
188
- By default, Burp Suite's proxy listens on localhost at port 8080, to use YAWAST with Burp Suite (or any proxy for that matter), just add this to the command line:
107
+ In addition to these tests, certain basic information is also displayed, such as IPs (and the PTR record for each IP), HTTP HEAD request, and others.
189
108
 
190
- `--proxy localhost:8080`
109
+ ### Usage
191
110
 
192
- ### Authenticated Testing
111
+ The most common usage scenario is as simple as:
193
112
 
194
- For authenticated testing, YAWAST allows you to specify a cookie to be passed via the `--cookie` parameter.
113
+ `yawast scan <url>`
195
114
 
196
- `--cookie SESSIONID=1234567890`
115
+ Detailed [usage information](https://github.com/adamcaudill/yawast/wiki/Usage-&-Parameters) is available on the wiki.
197
116
 
198
117
  ### Sample
199
118
 
200
- Using `scan` - the normal go-to option, here's what you get when scanning my website:
201
-
202
- ```
203
- $ yawast scan https://adamcaudill.com --tdessessioncount --dir --files --srv --subdomains
204
- __ _____ _ _ ___ _____ _____
205
- \ \ / / _ \| | | |/ _ \ / ___|_ _|
206
- \ V / /_\ \ | | / /_\ \\ `--. | |
207
- \ /| _ | |/\| | _ | `--. \ | |
208
- | || | | \ /\ / | | |/\__/ / | |
209
- \_/\_| |_/\/ \/\_| |_/\____/ \_/
210
-
211
- YAWAST v0.6.0.beta3 - The YAWAST Antecedent Web Application Security Toolkit
212
- Copyright (c) 2013-2017 Adam Caudill <adam@adamcaudill.com>
213
- Support & Documentation: https://github.com/adamcaudill/yawast
214
- Ruby 2.2.4-p230; OpenSSL 1.0.2j 26 Sep 2016 (x86_64-darwin16)
215
- Latest Version: YAWAST v0.5.2 is the officially supported version, please update.
216
-
217
- Scanning: https://adamcaudill.com/
218
-
219
- DNS Information:
220
- [I] 104.28.27.55 (N/A)
221
- [I] US - CLOUDFLARENET - CloudFlare, Inc.
222
- https://www.shodan.io/host/104.28.27.55
223
- https://censys.io/ipv4/104.28.27.55
224
- [I] 104.28.26.55 (N/A)
225
- [I] US - CLOUDFLARENET - CloudFlare, Inc.
226
- https://www.shodan.io/host/104.28.26.55
227
- https://censys.io/ipv4/104.28.26.55
228
- [I] 2400:CB00:2048:1::681C:1A37 (N/A)
229
- [I] US - CLOUDFLARENET - CloudFlare, Inc.
230
- https://www.shodan.io/host/2400:cb00:2048:1::681c:1a37
231
- [I] 2400:CB00:2048:1::681C:1B37 (N/A)
232
- [I] US - CLOUDFLARENET - CloudFlare, Inc.
233
- https://www.shodan.io/host/2400:cb00:2048:1::681c:1b37
234
- [I] TXT: v=spf1 mx a ptr include:_spf.google.com ~all
235
- [I] TXT: brave-ledger-verification=0262b8f382f60074e0131f65243fa7caba48b15eb664ec8d0d3e0b3a26a45b47
236
- [I] TXT: google-site-verification=QTO_7Q7UXmrUIwieJliLTXV3XuQdqNvTPVcug_TwH0w
237
- [I] MX: aspmx5.googlemail.com (30) - 64.233.165.27 (US - GOOGLE - Google Inc.)
238
- [I] MX: aspmx4.googlemail.com (30) - 173.194.69.27 (US - GOOGLE - Google Inc.)
239
- [I] MX: aspmx3.googlemail.com (30) - 74.125.140.26 (US - GOOGLE - Google Inc.)
240
- [I] MX: alt2.aspmx.l.google.com (20) - 74.125.140.27 (US - GOOGLE - Google Inc.)
241
- [I] MX: aspmx2.googlemail.com (30) - 209.85.202.27 (US - GOOGLE - Google Inc.)
242
- [I] MX: alt1.aspmx.l.google.com (20) - 209.85.202.26 (US - GOOGLE - Google Inc.)
243
- [I] MX: aspmx.l.google.com (10) - 74.125.31.27 (US - GOOGLE - Google Inc.)
244
- [I] NS: hal.ns.cloudflare.com - 173.245.59.174 (US - CLOUDFLARENET - CloudFlare, Inc.)
245
- [I] NS: vera.ns.cloudflare.com - 173.245.58.147 (US - CLOUDFLARENET - CloudFlare, Inc.)
246
- [I] SRV: _bittorrent._tcp.adamcaudill.com: example.com:1 - 93.184.216.34 (US - EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business)
247
- [I] A: www.adamcaudill.com: 104.28.27.55 (US - CLOUDFLARENET - CloudFlare, Inc.)
248
- [I] A: www.adamcaudill.com: 104.28.26.55 (US - CLOUDFLARENET - CloudFlare, Inc.)
249
- [I] CAA (adamcaudill.com): 0 iodef "mailto:adam@adamcaudill.com"
250
- [I] CAA (adamcaudill.com): 0 issue "digicert.com"
251
- [I] CAA (adamcaudill.com): 0 issue "comodoca.com"
252
- [I] CAA (adamcaudill.com): 0 issue "globalsign.com"
253
- [I] CAA (adamcaudill.com): 0 issue "letsencrypt.org"
254
- [I] CAA (com): No Records Found
255
-
256
- [I] HEAD:
257
- [I] date: Wed, 11 Oct 2017 16:08:38 GMT
258
- [I] content-type: text/html; charset=UTF-8
259
- [I] connection: close
260
- [I] set-cookie: __cfduid=0123456789abcdef; expires=Thu, 11-Oct-18 16:08:38 GMT; path=/; domain=.adamcaudill.com; HttpOnly
261
- [I] vary: Accept-Encoding,Cookie
262
- [I] last-modified: Wed, 04 Oct 2017 18:55:34 GMT
263
- [I] x-content-type-options: nosniff
264
- [I] x-frame-options: sameorigin
265
- [I] pragma: public
266
- [I] cache-control: public, max-age=86400
267
- [I] cf-cache-status: HIT
268
- [I] expires: Thu, 12 Oct 2017 16:08:38 GMT
269
- [I] strict-transport-security: max-age=15552000; preload
270
- [I] server: cloudflare-nginx
271
- [I] cf-ray: 3ac31446ce295308-MIA
272
-
273
- [I] NOTE: Server appears to be Cloudflare; WAF may be in place.
274
-
275
- [I] X-Frame-Options Header: sameorigin
276
- [I] X-Content-Type-Options Header: nosniff
277
- [W] Content-Security-Policy Header Not Present
278
- [W] Public-Key-Pins Header Not Present
279
-
280
- [I] Cookies:
281
- [I] __cfduid=0123456789abcdef; expires=Thu, 11-Oct-18 16:08:38 GMT; path=/; domain=.adamcaudill.com; HttpOnly
282
- [W] Cookie missing Secure flag
283
- [W] Cookie missing SameSite flag
284
-
285
-
286
- Beginning SSL Labs scan (this could take a minute or two)
287
- [SSL Labs] This assessment service is provided free of charge by Qualys SSL Labs, subject to our terms and conditions: https://www.ssllabs.com/about/terms.html
288
- .............................
289
-
290
- SSL Labs: https://www.ssllabs.com/ssltest/analyze.html?d=adamcaudill.com&hideResults=on
291
-
292
- [I] IP: 104.28.27.55 - Grade: A+
293
-
294
- Certificate Information:
295
- [I] Subject: CN=sni67677.cloudflaressl.com, OU=PositiveSSL Multi-Domain, OU=Domain Control Validated
296
- [I] Common Names: ["sni67677.cloudflaressl.com"]
297
- [I] Alternative names:
298
- [I] sni67677.cloudflaressl.com
299
- [I] *.adamcaudill.com
300
- [I] adamcaudill.com
301
- [I] Not Before: 2017-07-26T00:00:00+00:00
302
- [I] Not After: 2018-02-01T23:59:59+00:00
303
- [I] Key: EC 256 (RSA equivalent: 3072)
304
- [I] Public Key Hash: c4c5ab4bd6d16a18d32437ae35f2b5d22fa0a59b
305
- [I] Version: 2
306
- [I] Serial: 77574794376740264441751965250081500687
307
- [I] Issuer: COMODO ECC Domain Validation Secure Server CA 2
308
- [I] Signature algorithm: SHA256withECDSA
309
- [I] Extended Validation: No (Domain Control)
310
- [I] Certificate Transparency: No
311
- [I] OCSP Must Staple: No
312
- [I] Revocation information: CRL information available
313
- [I] Revocation information: OCSP information available
314
- [I] Revocation status: certificate not revoked
315
- [I] Extensions:
316
- [I] authorityKeyIdentifier = keyid:40:09:61:67:F0:BC:83:71:4F:DE:12:08:2C:6F:D4:D4:2B:76:3D:96,
317
- [I] subjectKeyIdentifier = D0:F8:D6:82:36:B5:5C:AC:2D:9A:8E:7B:D9:D5:E6:99:38:B6:8C:FE
318
- [I] keyUsage = critical, Digital Signature
319
- [I] basicConstraints = critical, CA:FALSE
320
- [I] extendedKeyUsage = TLS Web Server Authentication, TLS Web Client Authentication
321
- [I] certificatePolicies = Policy: 1.3.6.1.4.1.6449.1.2.2.7, CPS: https://secure.comodo.com/CPS, Policy: 2.23.140.1.2.1,
322
- [I] crlDistributionPoints = , Full Name:, URI:http://crl.comodoca4.com/COMODOECCDomainValidationSecureServerCA2.crl,
323
- [I] authorityInfoAccess = CA Issuers - URI:http://crt.comodoca4.com/COMODOECCDomainValidationSecureServerCA2.crt, OCSP - URI:http://ocsp.comodoca4.com,
324
- [I] Hash: 2cf22bbb21e5a3eaa042feadc8fbc86ff0d3b1e1
325
- https://censys.io/certificates?q=2cf22bbb21e5a3eaa042feadc8fbc86ff0d3b1e1
326
- https://crt.sh/?q=2cf22bbb21e5a3eaa042feadc8fbc86ff0d3b1e1
327
-
328
- Configuration Information:
329
- Protocol Support:
330
- [I] TLS 1.0
331
- [I] TLS 1.1
332
- [I] TLS 1.2
333
-
334
- Cipher Suite Support:
335
- [I] TLS_AES_128_GCM_SHA256 - 128-bits
336
- [I] TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 - 128-bits - ECDHE-256-bits
337
- [I] TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA - 128-bits - ECDHE-256-bits
338
- [I] TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 - 128-bits - ECDHE-256-bits
339
- [I] TLS_AES_256_GCM_SHA384 - 256-bits
340
- [I] TLS_CHACHA20_POLY1305_SHA256 - 256-bits
341
- [I] OLD_TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 - 256-bits - ECDHE-256-bits
342
- [I] TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 - 256-bits - ECDHE-256-bits
343
- [I] TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 - 256-bits - ECDHE-256-bits
344
- [I] TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA - 256-bits - ECDHE-256-bits
345
- [I] TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 - 256-bits - ECDHE-256-bits
346
-
347
- Handshake Simulation:
348
- [E] Android 2.3.7 - Simulation Failed
349
- [I] Android 4.0.4 - TLS 1.0 - TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
350
- [I] Android 4.1.1 - TLS 1.0 - TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
351
- [I] Android 4.2.2 - TLS 1.0 - TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
352
- [I] Android 4.3 - TLS 1.0 - TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
353
- [I] Android 4.4.2 - TLS 1.2 - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
354
- [I] Android 5.0.0 - TLS 1.2 - OLD_TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
355
- [I] Android 6.0 - TLS 1.2 - OLD_TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
356
- [I] Android 7.0 - TLS 1.2 - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
357
- [I] Baidu Jan 2015 - TLS 1.0 - TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
358
- [I] BingPreview Jan 2015 - TLS 1.2 - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
359
- [E] Chrome 49 / XP SP3 - Simulation Failed
360
- [I] Chrome 57 / Win 7 - - TLS_AES_128_GCM_SHA256
361
- [I] Firefox 31.3.0 ESR / Win 7 - TLS 1.2 - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
362
- [I] Firefox 47 / Win 7 - TLS 1.2 - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
363
- [I] Firefox 49 / XP SP3 - TLS 1.2 - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
364
- [I] Firefox 53 / Win 7 - - TLS_AES_128_GCM_SHA256
365
- [I] Googlebot Feb 2015 - TLS 1.2 - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
366
- [E] IE 6 / XP - Simulation Failed
367
- [I] IE 7 / Vista - TLS 1.0 - TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
368
- [E] IE 8 / XP - Simulation Failed
369
- [I] IE 8-10 / Win 7 - TLS 1.0 - TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
370
- [I] IE 11 / Win 7 - TLS 1.2 - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
371
- [I] IE 11 / Win 8.1 - TLS 1.2 - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
372
- [I] IE 10 / Win Phone 8.0 - TLS 1.0 - TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
373
- [I] IE 11 / Win Phone 8.1 - TLS 1.2 - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
374
- [I] IE 11 / Win Phone 8.1 Update - TLS 1.2 - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
375
- [I] IE 11 / Win 10 - TLS 1.2 - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
376
- [I] Edge 13 / Win 10 - TLS 1.2 - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
377
- [I] Edge 13 / Win Phone 10 - TLS 1.2 - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
378
- [E] Java 6u45 - Simulation Failed
379
- [I] Java 7u25 - TLS 1.0 - TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
380
- [I] Java 8u31 - TLS 1.2 - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
381
- [E] OpenSSL 0.9.8y - Simulation Failed
382
- [I] OpenSSL 1.0.1l - TLS 1.2 - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
383
- [I] OpenSSL 1.0.2e - TLS 1.2 - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
384
- [I] Safari 5.1.9 / OS X 10.6.8 - TLS 1.0 - TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
385
- [I] Safari 6 / iOS 6.0.1 - TLS 1.2 - TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
386
- [I] Safari 6.0.4 / OS X 10.8.4 - TLS 1.0 - TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
387
- [I] Safari 7 / iOS 7.1 - TLS 1.2 - TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
388
- [I] Safari 7 / OS X 10.9 - TLS 1.2 - TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
389
- [I] Safari 8 / iOS 8.4 - TLS 1.2 - TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
390
- [I] Safari 8 / OS X 10.10 - TLS 1.2 - TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
391
- [I] Safari 9 / iOS 9 - TLS 1.2 - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
392
- [I] Safari 9 / OS X 10.11 - TLS 1.2 - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
393
- [I] Safari 10 / iOS 10 - TLS 1.2 - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
394
- [I] Safari 10 / OS X 10.12 - TLS 1.2 - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
395
- [I] Apple ATS 9 / iOS 9 - TLS 1.2 - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
396
- [I] Yahoo Slurp Jan 2015 - TLS 1.2 - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
397
- [I] YandexBot Jan 2015 - TLS 1.2 - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
398
-
399
- Protocol & Vulnerability Information:
400
- [I] DROWN: No
401
- [I] Secure Renegotiation: secure renegotiation supported
402
- [I] POODLE (SSL): No
403
- [I] POODLE (TLS): No
404
- [I] Downgrade Prevention: Yes
405
- [I] Compression: No
406
- [I] Heartbleed: No
407
- [I] OpenSSL CCS (CVE-2014-0224): No
408
- [I] OpenSSL Padding Oracle (CVE-2016-2107): No
409
- [I] Forward Secrecy: Yes (all simulated clients)
410
- [I] OCSP Stapling: Yes
411
- [I] FREAK: No
412
- [I] Logjam: No
413
- [I] DH public server param (Ys) reuse: No
414
- [I] Protocol Intolerance: No
415
-
416
- Confirming your OpenSSL supports 3DES cipher suites...
417
- TLS Session Request Limit: Checking number of requests accepted using 3DES suites...
418
-
419
- [I] TLS Session Request Limit: Server does not support 3DES cipher suites
420
-
421
- [I] HSTS: Enabled (strict-transport-security: max-age=15552000; preload)
422
- [I] HSTS Preload: Chrome - false; Firefox - false; Tor - false
423
- SSL-Session:
424
- Protocol : TLSv1.2
425
- Cipher : ECDHE-ECDSA-AES128-GCM-SHA256
426
- Session-ID: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
427
- Session-ID-ctx:
428
- Master-Key: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
429
- Key-Arg : None
430
- PSK identity: None
431
- PSK identity hint: None
432
- SRP username: None
433
- TLS session ticket lifetime hint: 64800 (seconds)
434
- TLS session ticket:
435
- 0000 - ff ff ff ff ff ff ff ff-ff ff ff ff ff ff ff ff ................
436
- 0010 - ff ff ff ff ff ff ff ff-ff ff ff ff ff ff ff ff ................
437
- 0020 - ff ff ff ff ff ff ff ff-ff ff ff ff ff ff ff ff ................
438
- 0030 - ff ff ff ff ff ff ff ff-ff ff ff ff ff ff ff ff ................
439
- 0040 - ff ff ff ff ff ff ff ff-ff ff ff ff ff ff ff ff ................
440
- 0050 - ff ff ff ff ff ff ff ff-ff ff ff ff ff ff ff ff ................
441
- 0060 - ff ff ff ff ff ff ff ff-ff ff ff ff ff ff ff ff ................
442
- 0070 - ff ff ff ff ff ff ff ff-ff ff ff ff ff ff ff ff ................
443
- 0080 - ff ff ff ff ff ff ff ff-ff ff ff ff ff ff ff ff ................
444
- 0090 - ff ff ff ff ff ff ff ff-ff ff ff ff ff ff ff ff ................
445
- 00a0 - ff ff ff ff ff ff ff ff-ff ff ff ff ff ff ff ff ................
446
- 00b0 - ff ff ff ff ff ff ff ff-ff ff ff ff ff ff ff ff ................
447
- 00c0 - ff ff ff ff ff ff ff ff-ff ff ff ff ff ff ff ff ................
448
-
449
- Start Time: 1507738278
450
- Timeout : 300 (sec)
451
- Verify return code: 20 (unable to get local issuer certificate)
452
-
453
- [W] '/readme.html' found: https://adamcaudill.com/readme.html
454
-
455
-
456
- Checking for common files (this will take a few minutes)...
457
- [I] '/favicon.ico' found: https://adamcaudill.com/favicon.ico
458
- [I] '/license.txt' found: https://adamcaudill.com/license.txt
459
- [I] '/robots.txt' found: https://adamcaudill.com/robots.txt
460
- [I] '/sitemap_index.xml' found: https://adamcaudill.com/sitemap_index.xml
461
- [I] '/tools' found: https://adamcaudill.com/tools
462
- [I] '/wp-config.php' found: https://adamcaudill.com/wp-config.php
463
- [I] '/wp-links-opml.php' found: https://adamcaudill.com/wp-links-opml.php
464
- [I] '/wp-cron.php' found: https://adamcaudill.com/wp-cron.php
465
- [I] '/wp-load.php' found: https://adamcaudill.com/wp-load.php
466
- [I] '/wp-login.php' found: https://adamcaudill.com/wp-login.php
467
- [I] '/keybase.txt' found: https://adamcaudill.com/keybase.txt
468
-
469
- [I] Allow HTTP Verbs (OPTIONS): OPTIONS,GET,HEAD,POST
470
-
471
- Searching for common directories...
472
- [I] Found: 'https://adamcaudill.com//'
473
- [I] Found: 'https://adamcaudill.com/0000/'
474
- [I] Found: 'https://adamcaudill.com/2003/'
475
- [I] Found: 'https://adamcaudill.com/2008/'
476
- [I] Found: 'https://adamcaudill.com/2005/'
477
- [I] Found: 'https://adamcaudill.com/2004/'
478
- [I] Found: 'https://adamcaudill.com/2006/'
479
- [I] Found: 'https://adamcaudill.com/2009/'
480
- [I] Found: 'https://adamcaudill.com/2007/'
481
- [I] Found: 'https://adamcaudill.com/2015/'
482
- [I] Found: 'https://adamcaudill.com/2011/'
483
- [I] Found: 'https://adamcaudill.com/2012/'
484
- [I] Found: 'https://adamcaudill.com/2010/'
485
- [I] Found: 'https://adamcaudill.com/2013/'
486
- [I] Found: 'https://adamcaudill.com/2014/'
487
- [I] Found: 'https://adamcaudill.com/2016/'
488
- [I] Found: 'https://adamcaudill.com/2017/'
489
- [I] Found: 'https://adamcaudill.com/ABOUT/'
490
- [I] Found: 'https://adamcaudill.com/ARCHIVES/'
491
- [I] Found: 'https://adamcaudill.com/About/'
492
- [I] Found: 'https://adamcaudill.com/Archives/'
493
- [I] Found: 'https://adamcaudill.com/BLOG/'
494
- [I] Found: 'https://adamcaudill.com/Blog/'
495
- [I] Found: 'https://adamcaudill.com/Photo/'
496
- [I] Found: 'https://adamcaudill.com/Resume/'
497
- [I] Found: 'https://adamcaudill.com/TOOLS/'
498
- [I] Found: 'https://adamcaudill.com/Tools/'
499
- [I] Found: 'https://adamcaudill.com/about/'
500
- [I] Found: 'https://adamcaudill.com/archives/'
501
- [I] Found: 'https://adamcaudill.com/blog/'
502
- [I] Found: 'https://adamcaudill.com/feed/'
503
- [I] Found: 'https://adamcaudill.com/pgp/'
504
- [I] Found: 'https://adamcaudill.com/photo/'
505
- [I] Found: 'https://adamcaudill.com/reading/'
506
- [I] Found: 'https://adamcaudill.com/resume/'
507
- [I] Found: 'https://adamcaudill.com/speaking/'
508
- [I] Found: 'https://adamcaudill.com/tools/'
509
- [I] Found: 'https://adamcaudill.com/wp-content/'
510
-
511
- [I] Meta Generator: WordPress 4.8.2
512
- Scan complete.
513
- ```
514
-
515
- ### About The Output
516
-
517
- You'll notice that most lines begin with a letter in a bracket, this is to tell you how to interpret the result at a glance. There are four possible values:
518
-
519
- * [I] - This indicates that the line is informational, and doesn't necessarily indicate a security issue.
520
- * [W] - This is a Warning, which means that it could be an issue, or could expose useful information. These need to be evaluated on a case-by-case basis to determine the impact.
521
- * [V] - This is a Vulnerability, it indicates an issue that is known to be an issue, and needs to be addressed.
522
- * [E] - This indicates that an error occurred, sometimes these are serious and indicate an issue with your environment, the target server, or the application. In other cases, they may just be informational to let you know that something didn't go as planned.
523
-
524
- The indicator used may change over time based on new research or better detection techniques. In all cases, results should be carefully evaluated within the context of the application, how it's used, and what threats apply. The indicator is guidance, a hint if you will, it's up to you to determine the real impact.
525
-
526
- ### TLS / SSL Testing
527
-
528
- YAWAST offers two modes for testing TLS / SSL - one is custom, and most useful for internal systems, and the other uses the [SSL Labs](https://www.ssllabs.com/) API.
529
-
530
- #### Internal Mode
531
-
532
- To use the custom internal TLS / SSL scanner (which uses your copy of OpenSSL), simply pass `--internalssl` on the command line. Here is a sample of the output generated by this tester.
533
-
534
- ```
535
- [I] Found X509 Certificate:
536
- [I] Issued To: sni67677.cloudflaressl.com /
537
- [I] Issuer: COMODO ECC Domain Validation Secure Server CA 2 / COMODO CA Limited
538
- [I] Version: 2
539
- [I] Serial: 167670175484361448885961646389808341945
540
- [I] Subject: /OU=Domain Control Validated/OU=PositiveSSL Multi-Domain/CN=sni67677.cloudflaressl.com
541
- [I] Expires: 2017-07-02 23:59:59 UTC
542
- [I] Signature Algorithm: ecdsa-with-SHA256
543
- [I] Key: EC-prime256v1
544
- [I] Key Hash: 26c91946d32c2e664dd4c131ffd2b11bd6270331
545
- [I] Extensions:
546
- [I] authorityKeyIdentifier = keyid:40:09:61:67:F0:BC:83:71:4F:DE:12:08:2C:6F:D4:D4:2B:76:3D:96,
547
- [I] subjectKeyIdentifier = D0:F8:D6:82:36:B5:5C:AC:2D:9A:8E:7B:D9:D5:E6:99:38:B6:8C:FE
548
- [I] keyUsage = critical, Digital Signature
549
- [I] basicConstraints = critical, CA:FALSE
550
- [I] extendedKeyUsage = TLS Web Server Authentication, TLS Web Client Authentication
551
- [I] certificatePolicies = Policy: 1.3.6.1.4.1.6449.1.2.2.7, CPS: https://secure.comodo.com/CPS, Policy: 2.23.140.1.2.1,
552
- [I] crlDistributionPoints = , Full Name:, URI:http://crl.comodoca4.com/COMODOECCDomainValidationSecureServerCA2.crl,
553
- [I] authorityInfoAccess = CA Issuers - URI:http://crt.comodoca4.com/COMODOECCDomainValidationSecureServerCA2.crt, OCSP - URI:http://ocsp.comodoca4.com,
554
- [I] Alternate Names:
555
- [I] sni67677.cloudflaressl.com
556
- [I] *.adamcaudill.com
557
- [I] adamcaudill.com
558
- [I] Hash: 06746b606927dab24f9b339329639151112c9363
559
- https://censys.io/certificates?q=06746b606927dab24f9b339329639151112c9363
560
- https://crt.sh/?q=06746b606927dab24f9b339329639151112c9363
561
-
562
- [I] Certificate: Chain
563
- [I] Issued To: sni67677.cloudflaressl.com /
564
- [I] Issuer: COMODO ECC Domain Validation Secure Server CA 2 / COMODO CA Limited
565
- [I] Expires: 2017-07-02 23:59:59 UTC
566
- [I] Key: EC-prime256v1
567
- [I] Signature Algorithm: ecdsa-with-SHA256
568
- [I] Hash: 06746b606927dab24f9b339329639151112c9363
569
-
570
- [I] Issued To: COMODO ECC Domain Validation Secure Server CA 2 / COMODO CA Limited
571
- [I] Issuer: COMODO ECC Certification Authority / COMODO CA Limited
572
- [I] Expires: 2029-09-24 23:59:59 UTC
573
- [I] Key: EC-prime256v1
574
- [I] Signature Algorithm: ecdsa-with-SHA384
575
- [I] Hash: 75cfd9bc5cefa104ecc1082d77e63392ccba5291
576
-
577
- [I] Issued To: COMODO ECC Certification Authority / COMODO CA Limited
578
- [I] Issuer: AddTrust External CA Root / AddTrust AB
579
- [I] Expires: 2020-05-30 10:48:38 UTC
580
- [I] Key: EC-secp384r1
581
- [I] Signature Algorithm: sha384WithRSAEncryption
582
- [I] Hash: ae223cbf20191b40d7ffb4ea5701b65fdc68a1ca
583
-
584
-
585
- Qualys SSL Labs: https://www.ssllabs.com/ssltest/analyze.html?d=adamcaudill.com&hideResults=on
586
-
587
- Supported Ciphers (based on your OpenSSL version):
588
- Checking for TLSv1 suites (98 possible suites)
589
- [I] Version: TLSv1 Bits: 256 Cipher: ECDHE-ECDSA-AES256-SHA
590
- [I] Version: TLSv1 Bits: 128 Cipher: ECDHE-ECDSA-AES128-SHA
591
- [W] Version: TLSv1 Bits: 112 Cipher: ECDHE-ECDSA-DES-CBC3-SHA
592
- Checking for TLSv1_2 suites (98 possible suites)
593
- [I] Version: TLSv1.2 Bits: 256 Cipher: ECDHE-ECDSA-AES256-GCM-SHA384
594
- [I] Version: TLSv1.2 Bits: 256 Cipher: ECDHE-ECDSA-AES256-SHA384
595
- [I] Version: TLSv1.2 Bits: 256 Cipher: ECDHE-ECDSA-AES256-SHA
596
- [I] Version: TLSv1.2 Bits: 128 Cipher: ECDHE-ECDSA-AES128-GCM-SHA256
597
- [I] Version: TLSv1.2 Bits: 128 Cipher: ECDHE-ECDSA-AES128-SHA256
598
- [I] Version: TLSv1.2 Bits: 128 Cipher: ECDHE-ECDSA-AES128-SHA
599
- Checking for TLSv1_1 suites (98 possible suites)
600
- [I] Version: TLSv1.1 Bits: 256 Cipher: ECDHE-ECDSA-AES256-SHA
601
- [I] Version: TLSv1.1 Bits: 128 Cipher: ECDHE-ECDSA-AES128-SHA
602
- Checking for SSLv3 suites (98 possible suites)
603
-
604
- [I] HSTS: Enabled (strict-transport-security: max-age=15552000; preload)
605
- ```
606
-
607
- This version is more limited than the SSL Labs option, though will work in cases where SSL Labs is unable to connect to the target server.
608
-
609
- #### SSL Labs Mode
610
-
611
- The default mode is to use the SSL Labs API, which makes all users bound by their [terms and conditions](https://www.ssllabs.com/downloads/Qualys_SSL_Labs_Terms_of_Use.pdf), and obviously results in the domain you are scanning being sent to them.
612
-
613
- This mode is the most comprehensive, and contains far more data than the Internal Mode. Unless there is a good reason to use the Internal Mode, this is what you should use.
614
-
615
- ### About The Name
616
-
617
- When this project was started, the original name was "Yet Another Web Application Security Tool" - as the project became more serious, the name was changed. The current name better reflects the role of the tool, and its place in the penetration tester's workflow. It's meant to be a first step, to come before the serious manual work, and provide information to allow a tester to be up and running quicker. The tests that are performed are based on that goal, as well as the availability and complexity of tests in other tools. If another common tool can do a given task better, it won't be done here.
119
+ Sample output for a [scan](https://github.com/adamcaudill/yawast/wiki/Sample-Output) and [TLS-specific](https://github.com/adamcaudill/yawast/wiki/Scanning-TLS-(SSL)) checks are on the wiki.
618
120
 
619
121
  ### Special Thanks
620
122
 
621
123
  * [SecLists](https://github.com/danielmiessler/SecLists) - Various lists are based on the resources collected by this project.
622
- * [Shopify](https://www.shopify.com/) for [ssllabs.rb](https://github.com/Shopify/ssllabs.rb), which provides the Qualsys SSL Labs integration.
data/bin/yawast CHANGED
@@ -82,14 +82,3 @@ command :dns do |c|
82
82
  Yawast::Commands::DNS.process(args, options)
83
83
  end
84
84
  end
85
-
86
- command :cert do |c|
87
- c.syntax = './yawast cert --input <file>'
88
- c.description = 'Gets information about the certificates used'
89
-
90
- c.option '--input STRING', String, 'List of domains to check'
91
-
92
- c.action do |_, options|
93
- Yawast::Commands::Cert.process(options)
94
- end
95
- end