From a0e4f96a7b62bf1295b9d974727d1c1624310e01 Mon Sep 17 00:00:00 2001 From: Julien Vehent Date: Wed, 20 Nov 2013 10:30:45 -0500 Subject: [PATCH] Test all versions of SSL and TLS --- CiphersScan.sh | 51 ++++++++++++++++++++++++++++++++++++++++---------- 1 file changed, 41 insertions(+), 10 deletions(-) diff --git a/CiphersScan.sh b/CiphersScan.sh index 5d15571..7923ecc 100755 --- a/CiphersScan.sh +++ b/CiphersScan.sh @@ -23,21 +23,49 @@ verbose() { # Connect to a target host with the selected ciphersuite test_cipher_on_target() { local sslcommand=$@ - local tmp=$(mktemp) - $sslcommand 1>"$tmp" 2>/dev/null << EOF + cipher="" + protocols="" + pfs="" + for tls_version in "-ssl2" "-ssl3" "-tls1" "-tls1_1" "-tls1_2" + do + local tmp=$(mktemp) + $sslcommand $tls_version 1>"$tmp" 2>/dev/null << EOF $REQUEST EOF - # Parse the result - result="$(grep "New, " $tmp|awk '{print $5}') $(grep -E "^\s+Protocol\s+:" $tmp|awk '{print $3}') $(grep 'Server Temp Key' $tmp|awk '{print $4$5$6$7}')" - rm "$tmp" - if [ -z "$result" ]; then + current_cipher=$(grep "New, " $tmp|awk '{print $5}') + current_pfs=$(grep 'Server Temp Key' $tmp|awk '{print $4$5$6$7}') + current_protocol=$(grep -E "^\s+Protocol\s+:" $tmp|awk '{print $3}') + if [[ -z "$current_protocol" || "$current_cipher" == '(NONE)' ]]; then + # connection failed, try again with next TLS version + continue + fi + # connection succeeded, add TLS version to positive results + if [ -z "$protocols" ]; then + protocols=$current_protocol + else + protocols="$protocols,$current_protocol" + fi + cipher=$current_cipher + pfs=$current_pfs + # grab the cipher and PFS key size + rm "$tmp" + done + # if cipher is empty, that means none of the TLS version worked with + # the current cipher + if [ -z "$cipher" ]; then verbose "handshake failed, no ciphersuite was returned" result='ConnectionFailure' return 2 - elif [ "$result" == '(NONE) ' ]; then + + # if cipher contains NONE, the cipher wasn't accepted + elif [ "$cipher" == '(NONE) ' ]; then + result="$cipher $protocols $pfs" verbose "handshake failed, server returned ciphersuite '$result'" return 1 + + # the connection succeeded else + result="$cipher $protocols $pfs" verbose "handshake succeeded, server returned ciphersuite '$result'" return 0 fi @@ -67,15 +95,16 @@ EOF # Connect to the target and retrieve the chosen cipher +# recursively until the connection fails get_cipher_pref() { local ciphersuite="$1" local sslcommand="timeout $TIMEOUT $OPENSSLBIN s_client -connect $TARGET -cipher $ciphersuite" verbose "Connecting to '$TARGET' with ciphersuite '$ciphersuite'" test_cipher_on_target "$sslcommand" local success=$? - cipherspref=("${cipherspref[@]}" "$result") # If the connection succeeded with the current cipher, benchmark and store if [ $success -eq 0 ]; then + cipherspref=("${cipherspref[@]}" "$result") pciph=$(echo $result|awk '{print $1}') get_cipher_pref "!$pciph:$ciphersuite" return 0 @@ -111,6 +140,8 @@ results=() # Call to the recursive loop that retrieves the cipher preferences get_cipher_pref $CIPHERSUITE + +# Display the results ctr=1 for cipher in "${cipherspref[@]}"; do pciph=$(echo $cipher|awk '{print $1}') @@ -125,9 +156,9 @@ for cipher in "${cipherspref[@]}"; do done if [ $DOBENCHMARK -eq 1 ]; then - header="prio ciphersuite protocol pfs_keysize avg_handshake_microsec" + header="prio ciphersuite protocols pfs_keysize avg_handshake_microsec" else - header="prio ciphersuite protocol pfs_keysize" + header="prio ciphersuite protocols pfs_keysize" fi ctr=0 for result in "${results[@]}"; do