small tips: ssl cipher tests

# cat /etc/redhat-release ;uname -ri Fedora release 19 (Schrödinger’s Cat) 3.10.9-200.fc19.x86_64 x86_64

download the following script

http://www.pentesterscripting.com/discovery/ssl_tests

# bunzip2 tlssled.sh.bz2 # chmod u+x tlssled.sh

before using this script, install sslscan which is required to run the script.

# yum install -y sslscan

run the script

# ./tlssled.sh 192.168.100.170 443 ------------------------------------------------------ TLSSLed - (1.0) based on sslscan and openssl by Raul Siles (www.taddong.com) ( inspired by ssl_test.sh by Aung Khant ) ------------------------------------------------------ + openssl version: OpenSSL 1.0.1e-fips 11 Feb 2013 + sslscan version 1.8.2 ------------------------------------------------------ [*] Analyzing SSL/TLS on 192.168.100.170:443 ... [*] Running sslscan on 192.168.100.170:443... [*] Testing for SSLv2 ... [*] Testing for NULL cipher ... [*] Testing for weak ciphers (based on key length) ... [*] Testing for strong ciphers (AES) ...    Accepted  SSLv3  256 bits  DHE-RSA-AES256-SHA    Accepted  SSLv3  256 bits  AES256-SHA    Accepted  SSLv3  128 bits  DHE-RSA-AES128-SHA    Accepted  SSLv3  128 bits  AES128-SHA    Accepted  TLSv1  256 bits  DHE-RSA-AES256-SHA    Accepted  TLSv1  256 bits  AES256-SHA    Accepted  TLSv1  128 bits  DHE-RSA-AES128-SHA    Accepted  TLSv1  128 bits  AES128-SHA [*] Testing for MD5 signed certificate ... [*] Checking preferred server ciphers ...  Prefered Server Cipher(s):    SSLv3  256 bits  DHE-RSA-AES256-SHA    TLSv1  256 bits  DHE-RSA-AES256-SHA [*] Testing for SSLv3/TLSv1 renegotiation vuln. (CVE-2009-3555) ... depth=0 CN = ubuntu.defaultdomain verify error:num=18:self signed certificate verify return:1 depth=0 CN = ubuntu.defaultdomain verify return:1 RENEGOTIATING Secure Renegotiation IS supported 139944629389216:error:1409E0E5:SSL routines:SSL3_WRITE_BYTES:ssl handshake failure:s3_pkt.c:596: [*] New files created: -rw-r--r--. 1 root root 9701  9月  3 00:45 sslscan_192.168.100.170:443_2013-09-03_00:45:03.log [*] done

sslscan : Fast SSL scanner

small tips.

https://www.titania-security.com/ -> Resources -> sslscan

sslscan lists what type of SSL cipher suites your server supports.

install sslcan via apt-get

# tail -1 /etc/lsb-release DISTRIB_DESCRIPTION="Ubuntu 12.04.2 LTS" # uname -ri 3.2.0-44-generic x86_64 # apt-get install -y sslscan

sslscan host:port

If you would like to know the usage of sslscan more , please check “man sslscan”

# sslscan 127.0.0.1:443 Testing SSL server 127.0.0.1 on port 443  Supported Server Cipher(s):    Failed    SSLv3  256 bits  ECDHE-RSA-AES256-GCM-SHA384    Failed    SSLv3  256 bits  ECDHE-ECDSA-AES256-GCM-SHA384  Prefered Server Cipher(s):    SSLv3  128 bits  RC4-SHA    TLSv1  128 bits  RC4-SHA  SSL Certificate:    Version: 0    Serial Number: -18403659056578741564    Signature Algorithm: sha1WithRSAEncryption