Skip to content

Conversation

@Captain-T2004
Copy link
Contributor

Checklist

  • I have followed the Contributor Guidelines.
  • The code has been thoroughly tested in my local development environment with flake8 and pylint.
  • The code is Python 3 compatible.
  • The code follows the PEP8 styling guidelines with 4 spaces indentation.
  • This Pull Request relates to only one issue or only one feature
  • I have referenced the corresponding issue number in my commit message
  • I have added the relevant documentation.
  • My branch is up-to-date with the Upstream master branch.

Changes proposed in this pull request

I have added the SSL/TLS Modules to Nettacker which can detect for weak SSL versions, weak cypher suite and SSL certificate related vulnerabilities.

Your development environment

  • OS: Kali GNU/Linux Rolling x86_64
  • OS Version: 6.8.11-amd64
  • Python Version: 3.11.9

return None

try:
socket_connection = ssl.wrap_socket(socket_connection)

Check failure

Code scanning / CodeQL

Default version of SSL/TLS may be insecure

Call to deprecated method ssl.wrap_socket does not specify a protocol, which may result in an insecure default being used.
Copy link
Collaborator

@arkid15r arkid15r left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for adjusting the code to the new structure. The tests are very appreciated too!

I have a couple of minor comments and looking forward to hearing @securestep9's input

Thanks for implementing this @Captain-T2004

@arkid15r arkid15r requested a review from securestep9 August 26, 2024 15:54
Co-authored-by: Arkadii Yakovets <[email protected]>
Signed-off-by: Akshay Behl <[email protected]>
Captain-T2004 and others added 2 commits August 31, 2024 02:35
Co-authored-by: Arkadii Yakovets <[email protected]>
Signed-off-by: Akshay Behl <[email protected]>
1. Change the date format from d/m/Y to Y-m-d (e.g. 2004-08-28)

2. In the return/output of ssl_certificate_scan in SSL library please  add certificate "subject" and "issuer" so these could be logged

3. Rename ssl_version module to ssl_weak_version

4. Change ssl_expired_certificate module to return expired certs only ( do not count expiring_soon certs - it is not a vulnerability!)

5. Create a separate ssl_expiring_certificate module in modules/scan (remember  'expiring soon'  is not a vulnerability, so we need to make this a 'scan' module)

6. Rename ssl_signed_certificate module to ssl_certificate_weak_signature and remove the self-signed check from it

7. Create a separate ssl_self_signed_certificate module in modules/vuln

Next in  nettacker/core/lib/ssl.py
 in class SslLibrary(BaseLibrary): you have ssl_certificate_scan and ssl_version_and_cipher_scan methods.
 There is a common code in these two methods so these could be refactored to remove the repetition.  Please refactor/improve this.
 In ssl_version_and_cipher_scan also please add add  to the output /return certificate "subject" ,"issuer" and an expiry date.
 This way if a user scans they network using IP addresses and some servers will come up with weak SSL versions/ciphers it will be easier for user to identify the servers using the certificate subject/issuer
socket_connection = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
socket_connection.settimeout(timeout)
socket_connection.connect((host, port))
socket_connection = context.wrap_socket(socket_connection, server_hostname=host)

Check failure

Code scanning / CodeQL

Use of insecure SSL/TLS version

Insecure SSL/TLS protocol version TLSv1 allowed by [call to ssl.create_default_context](1). Insecure SSL/TLS protocol version TLSv1_1 allowed by [call to ssl.create_default_context](1).
arkid15r and others added 6 commits August 31, 2024 19:07
1. changed the date format from "%Y/%m/%d" to "%Y-%m-%d" to make it ANSI and ISO 8601 compliant.

2. Changed the issuer and subject to issuer_str and subject_str which are formatted string from the x509 objects.

3. Added subject to  ssl_expired_certificate_vuln and ssl_expiring_certificate_scan modules
@securestep9 securestep9 self-assigned this Sep 4, 2024
@securestep9 securestep9 added the gsoc GSoC work label Sep 4, 2024
Copy link
Collaborator

@securestep9 securestep9 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you for your hard work during GSoC 2024 @Captain-T2004 !

@securestep9 securestep9 merged commit 28f1d90 into OWASP:master Sep 4, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

gsoc GSoC work

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants