[WEB SECURITY] Tool - SSL Audit (alpha)

Thierry Zoller Thierry at Zoller.lu
Thu Feb 18 08:47:31 EST 2010


Dear List,
Developed as part of G-SEC's investigation for the
"Secure SSL/TLS configuration Report 2010" (to be published)
we developed this little tool called SSL Audit.

It is in alpha stage and thought it has a little interesting
gimmick, don't expect too much.

It  implements  it's  own tiny SSL parsing engine and does not rely on
OpenSSL or any other SSL Engine - This implies that it can detect
ciphers suites not supported by OpenSSL and others.

Apart from scanning available ciphersuites it has an interesting tidbit
The Fingerprint mode (Experimental). Included is an experimental
fingerprint engine that tries to determine the SSL Engine used server
side. It does so by sending normal and malformed SSL packets that can
be interpreted in different ways.

SSL Audit is able to fingerprint :
· IIS7.5 (Schannel)
· IIS7.0 (Schannel)
· IIS 6.0 (Schannel)
· Apache (Openssl)
· Apache (NSS)
· Certicom
· RSA BSAFE

Blog Post :
http://blog.g-sec.lu/2010/02/ssltls-audit-alpha-tool-release.html

Documentation:
http://www.g-sec.lu/sslaudit/documentation.pdf

Regards,
Thierry Zoller



----------------------------------------------------------------------------
Join us on IRC: irc.freenode.net #webappsec

Have a question? Search The Web Security Mailing List Archives: 
http://www.webappsec.org/lists/websecurity/archive/

Subscribe via RSS: 
http://www.webappsec.org/rss/websecurity.rss [RSS Feed]

Join WASC on LinkedIn
http://www.linkedin.com/e/gis/83336/4B20E4374DBA



More information about the websecurity mailing list