-
-
Notifications
You must be signed in to change notification settings - Fork 948
Added SSL/TLS Modules #876
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
arkid15r
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks for adjusting the code to the new structure. The tests are very appreciated too!
I have a couple of minor comments and looking forward to hearing @securestep9's input
Thanks for implementing this @Captain-T2004
Co-authored-by: Arkadii Yakovets <[email protected]> Signed-off-by: Akshay Behl <[email protected]>
Co-authored-by: Arkadii Yakovets <[email protected]> Signed-off-by: Akshay Behl <[email protected]>
1. Change the date format from d/m/Y to Y-m-d (e.g. 2004-08-28) 2. In the return/output of ssl_certificate_scan in SSL library please add certificate "subject" and "issuer" so these could be logged 3. Rename ssl_version module to ssl_weak_version 4. Change ssl_expired_certificate module to return expired certs only ( do not count expiring_soon certs - it is not a vulnerability!) 5. Create a separate ssl_expiring_certificate module in modules/scan (remember 'expiring soon' is not a vulnerability, so we need to make this a 'scan' module) 6. Rename ssl_signed_certificate module to ssl_certificate_weak_signature and remove the self-signed check from it 7. Create a separate ssl_self_signed_certificate module in modules/vuln Next in nettacker/core/lib/ssl.py in class SslLibrary(BaseLibrary): you have ssl_certificate_scan and ssl_version_and_cipher_scan methods. There is a common code in these two methods so these could be refactored to remove the repetition. Please refactor/improve this. In ssl_version_and_cipher_scan also please add add to the output /return certificate "subject" ,"issuer" and an expiry date. This way if a user scans they network using IP addresses and some servers will come up with weak SSL versions/ciphers it will be easier for user to identify the servers using the certificate subject/issuer
| socket_connection = socket.socket(socket.AF_INET, socket.SOCK_STREAM) | ||
| socket_connection.settimeout(timeout) | ||
| socket_connection.connect((host, port)) | ||
| socket_connection = context.wrap_socket(socket_connection, server_hostname=host) |
Check failure
Code scanning / CodeQL
Use of insecure SSL/TLS version
1. changed the date format from "%Y/%m/%d" to "%Y-%m-%d" to make it ANSI and ISO 8601 compliant. 2. Changed the issuer and subject to issuer_str and subject_str which are formatted string from the x509 objects. 3. Added subject to ssl_expired_certificate_vuln and ssl_expiring_certificate_scan modules
securestep9
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thank you for your hard work during GSoC 2024 @Captain-T2004 !
Checklist
Changes proposed in this pull request
I have added the SSL/TLS Modules to Nettacker which can detect for weak SSL versions, weak cypher suite and SSL certificate related vulnerabilities.
Your development environment
Kali GNU/Linux Rolling x86_646.8.11-amd643.11.9