diff --git a/sslscan.c b/sslscan.c index c9bc57a0..1c34bc13 100644 --- a/sslscan.c +++ b/sslscan.c @@ -1038,7 +1038,8 @@ int testHeartbleed(struct sslCheckOptions *options, const SSL_METHOD *sslMethod) { // Credit to Jared Stafford (jspenguin@jspenguin.org) - char hello[] = {0x16,0x03,0x00,0x00,0xdc,0x01,0x00,0x00,0xd8,0x03,0x02,0x53,0x43,0x5b,0x90,0x9d,0x9b,0x72,0x0b,0xbc,0x0c,0xbc,0x2b,0x92,0xa8,0x48,0x97,0xcf,0xbd,0x39,0x04,0xcc,0x16,0x0a,0x85,0x03,0x90,0x9f,0x77,0x04,0x33,0xd4,0xde,0x00,0x00,0x66,0xc0,0x14,0xc0,0x0a,0xc0,0x22,0xc0,0x21,0x00,0x39,0x00,0x38,0x00,0x88,0x00,0x87,0xc0,0x0f,0xc0,0x05,0x00,0x35,0x00,0x84,0xc0,0x12,0xc0,0x08,0xc0,0x1c,0xc0,0x1b,0x00,0x16,0x00,0x13,0xc0,0x0d,0xc0,0x03,0x00,0x0a,0xc0,0x13,0xc0,0x09,0xc0,0x1f,0xc0,0x1e,0x00,0x33,0x00,0x32,0x00,0x9a,0x00,0x99,0x00,0x45,0x00,0x44,0xc0,0x0e,0xc0,0x04,0x00,0x2f,0x00,0x96,0x00,0x41,0xc0,0x11,0xc0,0x07,0xc0,0x0c,0xc0,0x02,0x00,0x05,0x00,0x04,0x00,0x15,0x00,0x12,0x00,0x09,0x00,0x14,0x00,0x11,0x00,0x08,0x00,0x06,0x00,0x03,0x00,0xff,0x01,0x00,0x00,0x49,0x00,0x0b,0x00,0x04,0x03,0x00,0x01,0x02,0x00,0x0a,0x00,0x34,0x00,0x32,0x00,0x0e,0x00,0x0d,0x00,0x19,0x00,0x0b,0x00,0x0c,0x00,0x18,0x00,0x09,0x00,0x0a,0x00,0x16,0x00,0x17,0x00,0x08,0x00,0x06,0x00,0x07,0x00,0x14,0x00,0x15,0x00,0x04,0x00,0x05,0x00,0x12,0x00,0x13,0x00,0x01,0x00,0x02,0x00,0x03,0x00,0x0f,0x00,0x10,0x00,0x11,0x00,0x23,0x00,0x00,0x00,0x0f,0x00,0x01,0x01}; + char hello[] = {0x16,0x03,0x00,0x00,0xdc,0x01,0x00,0x00,0xd8,0x03,0x02,0x53,0x43,0x5b,0x90,0x9d,0x9b,0x72,0x0b,0xbc,0x0c,0xbc,0x2b,0x92,0xa8,0x48,0x97,0xcf,0xbd,0x39,0x04,0xcc,0x16,0x0a,0x85,0x03,0x90,0x9f,0x77,0x04,0x33,0xd4,0xde,0x00,0x00,0x66,0xc0,0x14,0xc0,0x0a,0xc0,0x22,0xc0,0x21,0x00,0x39,0x00,0x38,0x00,0x88,0x00,0x87,0xc0,0x0f,0xc0,0x05,0x00,0x35,0x00,0x84,0xc0,0x12,0xc0,0x08,0xc0,0x1c,0xc0,0x1b,0x00,0x16,0x00,0x13,0xc0,0x0d,0xc0,0x03,0x00,0x0a,0xc0,0x13,0xc0,0x09,0xc0,0x1f,0xc0,0x1e,0x00,0x33,0x00,0x32,0x00,0x9a,0x00,0x99,0x00,0x45,0x00,0x44,0xc0,0x0e,0xc0,0x04,0x00,0x2f,0x00,0x96,0x00,0x41,0xc0,0x11,0xc0,0x07,0xc0,0x0c,0xc0,0x02,0x00,0x05,0x00,0x04,0x00,0x15,0x00,0x12,0x00,0x09,0x00,0x14,0x00,0x11,0x00,0x08,0x00,0x06,0x00,0x03,0x00,0xff,0x01,0x00,0x00,0x49,0x00,0x0b,0x00,0x04,0x03,0x00,0x01,0x02,0x00,0x0a,0x00,0x34,0x00,0x32,0x00,0x0e,0x00,0x0d,0x00,0x19,0x00,0x0b,0x00,0x0c,0x00,0x18,0x00,0x09,0x00,0x0a,0x00,0x16,0x00,0x17,0x00,0x08,0x00,0x06,0x00,0x07,0x00,0x14,0x00,0x15,0x00,0x04,0x00,0x05, +0x00,0x12,0x00,0x13,0x00,0x01,0x00,0x02,0x00,0x03,0x00,0x0f,0x00,0x10,0x00,0x11,0x00,0x23,0x00,0x00,0x00,0x0f,0x00,0x01,0x01}; if (sslMethod == TLSv1_client_method()) { @@ -1215,6 +1216,7 @@ int testCipher(struct sslCheckOptions *options, struct sslCipher *sslCipherPoint char requestBuffer[200]; char buffer[50]; int resultSize = 0; + char *safetyLevel; const char *sslMethod = printableSslMethod(sslCipherPointer->sslMethod); // Create request buffer... @@ -1383,33 +1385,40 @@ int testCipher(struct sslCheckOptions *options, struct sslCipher *sslCipherPoint if (strstr(sslCipherPointer->name, "NULL")) { printf("%s%-29s%s", COL_RED_BG, sslCipherPointer->name, RESET); + safetyLevel = "red_bg"; } else if (strstr(sslCipherPointer->name, "ADH") || strstr(sslCipherPointer->name, "AECDH")) { printf("%s%-29s%s", COL_PURPLE, sslCipherPointer->name, RESET); + safetyLevel = "purple"; } else if (strstr(sslCipherPointer->name, "EXP") || (sslCipherPointer->sslMethod == SSLv3_client_method() && !strstr(sslCipherPointer->name, "RC4"))) { printf("%s%-29s%s", COL_RED, sslCipherPointer->name, RESET); + safetyLevel = "red"; } else if (strstr(sslCipherPointer->name, "RC4")) { printf("%s%-29s%s", COL_YELLOW, sslCipherPointer->name, RESET); + safetyLevel = "yellow"; } else if (strstr(sslCipherPointer->name, "GCM")) { printf("%s%-29s%s", COL_GREEN, sslCipherPointer->name, RESET); + safetyLevel = "green"; } else { printf("%-29s", sslCipherPointer->name); + safetyLevel = "gray"; } if (options->cipher_details == true) { ssl_print_tmp_key(options, ssl); } + printf_xml(" safety-level=\"%s\" />\n", safetyLevel); printf("\n"); - printf_xml(" />\n"); + } // Disconnect SSL over socket diff --git a/sslscan.h b/sslscan.h index 96ffa32f..11d5ad95 100644 --- a/sslscan.h +++ b/sslscan.h @@ -86,7 +86,8 @@ const char *program_banner = " _\n" " ___ ___| |___ ___ __ _ _ __\n" " / __/ __| / __|/ __/ _` | '_ \\\n" " \\__ \\__ \\ \\__ \\ (_| (_| | | | |\n" - " |___/___/_|___/\\___\\__,_|_| |_|\n\n"; + " |___/___/_|___/\\___\\__,_|_| |_|\n\n" + " Little Fork by Janiko71 \n\n"; struct sslCipher { diff --git a/sslscan.xsl b/sslscan.xsl new file mode 100644 index 00000000..44031a6f --- /dev/null +++ b/sslscan.xsl @@ -0,0 +1,130 @@ + + + + + + + + + + + + +

:

+ + + + +

La compression TLS n'est pas supportée.

+
+ +

La compression TLS est supportée.

+
+
+ + + + + + +

La renégociation n'est pas supportée.

+
+ +

La renégociation est supportée de façon + + +

non sécurisée !
+
+ +
sécurisée.
+
+
+

+ + + + + + + + + + +
Vulnérable
à HeartBleed en TLS 1.0.
+
+
+ + +
Vulnérable
à HeartBleed en TLS 1.1.
+
+
+ + +
Vulnérable
à HeartBleed en TLS 1.2.
+
+
+ + + + + + Non vulnérable à la faille HeartBleed. + + + +

Algorithmes préférés

+ + + + + + + + + + + + + +
Version SSLAlgorithmeLongueur (bits)
+ + +

Algorithmes supportés

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Version SSLAlgorithmeLongueur (bits)
+ + + +
+