| Name | Last Modified | Size | Type |
|---|---|---|---|
| openssl-1.0.2i-chacha.pm.ipv6.contributed/ | 2016-Jun-06 20:45:45 | -- | Directory |
| CHANGELOG.txt | 2015-Sep-15 10:56:45 | 12.27KB | TXT Type Document |
| LICENSE.txt | 2014-May-03 11:04:22 | 17.59KB | TXT Type Document |
| OPENSSL-LICENSE.txt | 2015-Oct-13 00:12:23 | 58.08KB | TXT Type Document |
| bash-heartbleed.changelog.txt | 2014-May-03 17:37:15 | 572.00B | TXT Type Document |
| bash-heartbleed.sh | 2015-Oct-27 15:11:18 | 3.98KB | SH File |
| ccs-injection.sh | 2014-Jun-14 23:44:42 | 3.94KB | SH File |
| mapping-rfc.txt | 2014-Dec-21 00:52:13 | 15.88KB | TXT Type Document |
| openssl-1.0.2e-chacha.pm.tar.gz | 2015-Sep-15 09:23:07 | 11.65MB | GZ Compressed Archive |
| openssl-1.0.2e-chacha.pm.tar.gz.asc | 2015-Sep-16 01:17:54 | 828.00B | ASC File |
| openssl-1.0.2i-chacha.pm.ipv6.Linux+FreeBSD.tar.gz | 2016-Jun-23 11:34:57 | 9.45MB | GZ Compressed Archive |
| openssl-1.0.2i-chacha.pm.ipv6.Linux+FreeBSD.tar.gz.asc | 2016-Jun-23 11:33:36 | 811.00B | ASC File |
| openssl-ms14-066.Linux.x86_64 | 2016-Apr-15 12:36:23 | 4.24MB | X86_64 File |
| openssl-rfc.mappping.html | 2016-Feb-06 16:19:09 | 57.88KB | HTML File |
| testssl.sh | 2015-Sep-29 22:00:48 | 169.50KB | SH File |
| testssl.sh.asc | 2015-Sep-29 22:01:58 | 828.00B | ASC File |
testssl.sh is a free command line tool which checks a server's service
on any port for the support of TLS/SSL ciphers, protocols as well as recent cryptographic flaws and more.
testssl.sh is pretty much portable/compatible. It is working on every Linux, Mac OS X, FreeBSD distribution, on MSYS2/Cygwin.
It is supposed also to work on any other unixoid systems.
A newer OpenSSL version (1.0) is needed though. /bin/bash is a prerequisite –
otherwise there would be no sockets.
testssl.sh will improve over
time as more and more checks are done via bash sockets.
Development takes place at github. Here at testssl.sh you find the
latest stable version and documentation. As I do releases on github you can as well pull the zip from a stable release there. (Note the feature: curl -L testssl.sh
or wget -O - testssl.sh downloads the stable version right away, curl -L testssl.sh/dev/ or wget -O - testssl.sh/dev/
the development version from github. You miss the accompanying files though.)
2.8 (soon coming)
2.6 Features (Sep 2015)
testssl.sh commands are being read from, see hereuserid@somehost:~ % testssl.sh
testssl.sh <options>
-h, --help what you're looking at
-b, --banner displays banner + version of testssl.sh
-v, --version same as previous
-V, --local pretty print all local ciphers
-V, --local <pattern> which local ciphers with <pattern> are available?
(if pattern not a number: word match)
testssl.sh <options> URI ("testssl.sh URI" does everything except -E)
-e, --each-cipher checks each local cipher remotely
-E, --cipher-per-proto checks those per protocol
-f, --ciphers checks common cipher suites
-p, --protocols checks TLS/SSL protocols
-S, --server_defaults displays the servers default picks and certificate info
-P, --preference displays the servers picks: protocol+cipher
-y, --spdy, --npn checks for SPDY/NPN
-x, --single-cipher <pattern> tests matched <pattern> of ciphers
(if <pattern> not a number: word match)
-U, --vulnerable tests all vulnerabilities
-B, --heartbleed tests for heartbleed vulnerability
-I, --ccs, --ccs-injection tests for CCS injection vulnerability
-R, --renegotiation tests for renegotiation vulnerabilities
-C, --compression, --crime tests for CRIME vulnerability
-T, --breach tests for BREACH vulnerability
-O, --poodle tests for POODLE (SSL) vulnerability
-Z, --tls-fallback checks TLS_FALLBACK_SCSV mitigation
-F, --freak tests for FREAK vulnerability
-A, --beast tests for BEAST vulnerability
-J, --logjam tests for LOGJAM vulnerability
-s, --pfs, --fs,--nsa checks (perfect) forward secrecy settings
-4, --rc4, --appelbaum which RC4 ciphers are being offered?
-H, --header, --headers tests HSTS, HPKP, server/app banner, security headers, cookie, reverse proxy, IPv4 address
special invocations:
-t, --starttls <protocol> does a default run against a STARTTLS enabled <protocol>
--xmpphost <to_domain> for STARTTLS enabled XMPP it supplies the XML stream to-'' domain -- sometimes needed
--mx <domain/host> tests MX records from high to low priority (STARTTLS, port 25)
--ip <ipv4> a) tests the supplied <ipv4> instead of resolving host(s) in URI
b) arg "one" means: just test the first DNS returns (useful for multiple IPs)
--file <file name> mass testing option: Just put multiple testssl.sh command lines in <file name>,
one line per instance. Comments via # allowed, EOF signals end of <file name>.
partly mandatory parameters:
URI host|host:port|URL|URL:port (port 443 is assumed unless otherwise specified)
pattern an ignore case word pattern of cipher hexcode or any other string in the name, kx or bits
protocol is one of ftp,smtp,pop3,imap,xmpp,telnet,ldap (for the latter two you need e.g. the supplied openssl)
tuning options:
--assuming-http if protocol check fails it assumes HTTP protocol and enforces HTTP checks
--ssl-native fallback to checks with OpenSSL where sockets are normally used
--openssl <PATH> use this openssl binary (default: look in $PATH, $RUN_DIR of testssl.sh
--proxy <host>:<port> connect via the specified HTTP proxy
--sneaky be less verbose wrt referer headers
--quiet don't output the banner. By doing this you acknowledge usage terms normally appearing in the banner
--wide wide output for tests like RC4, BEAST. PFS also with hexcode, kx, strength, RFC name
--show-each for wide outputs: display all ciphers tested -- not only succeeded ones
--warnings <batch|off|false> "batch" doesn't wait for keypress, "off" or "false" skips connection warning
--color <0|1|2> 0: no escape or other codes, 1: b/w escape codes, 2: color (default)
--debug <0-6> 1: screen output normal but debug output in temp files. 2-6: see line ~105
All options requiring a value can also be called with '=' (e.g. testssl.sh -t=smtp --wide --openssl=/usr/bin/openssl <URI>.
<URI> is always the last parameter.
Need HTML output? Just pipe through "aha" (Ansi HTML Adapter: github.com/theZiz/aha) like
"testssl.sh <options> <URI> | aha >output.html"
userid@somehost:~ %
testssl.sh --starttls smtp <smtphost>.<tld>:587 testssl.sh --starttls ftp <ftphost>.<tld>:21 testssl.sh -t xmpp <jabberhost>.<tld>:5222 testssl.sh -t xmpp --xmpphost <XMPP domain> <jabberhost>.<tld>:5222 testssl.sh --starttls imap <imaphost>.<tld>:143The ports in those examples above are just the standard ports. Also here you're free to check any port.
testssl.sh is using LibreSSL as it has lots of stuff disabled.
testssl.sh
via environment variable where your openssl binary is:
export OPENSSL=<path_to_myopenssl>before you use testssl or using the option --openssl=<path_to_myopenssl>. Last but not least
$PATH is also used to find your OpenSSL binary.
testssl.sh is not locking those versions out yet but things might not work as expected. Support will be retired by Jan 2016.
If you insist on using crippled – in the sense of this tool –
binaries, you'll get a warning in magenta, see e.g. picture on the left hand side (middle of this page).