{"id":3236,"date":"2011-12-07T21:29:26","date_gmt":"2011-12-07T21:29:26","guid":{"rendered":"https:\/\/www.darknet.org.uk\/?p=3236"},"modified":"2015-09-09T19:37:03","modified_gmt":"2015-09-09T11:37:03","slug":"sslyze-fast-and-full-featured-ssl-configuration-scanner","status":"publish","type":"post","link":"https:\/\/www.darknet.org.uk\/2011\/12\/sslyze-fast-and-full-featured-ssl-configuration-scanner\/","title":{"rendered":"sslyze &#8211; Fast and Full-Featured SSL Configuration Scanner"},"content":{"rendered":"<p>Transport Layer Security (TLS), commonly called SSL, is one of the most widely used protocols to secure network communications. As costs fall and user security and privacy expectations rise companies are deploying it more widely every year. Attacks against the CA system, SSL implementation flaws and aging protocol versions have grabbed news headlines, bringing attention to weak configurations, and the need to avoid them. Additionally, server misconfiguration has always greatly increased the overhead caused by SSL, slowing the transition to improved communications security.<\/p>\n<p>To help improve system configurations, iSEC is releasing the free software \u201cSSLyze\u201d tool. They have found this tool helpful for analyzing the configuration of SSL servers and for identifying misconfiguration such as the use of outdated protocol versions, weak hash algorithms in trust chains, insecure renegotiation, and session resumption settings.<\/p>\n<script async src=\"https:\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-3033787195489589\"\r\n     crossorigin=\"anonymous\"><\/script>\r\n<!-- Darknet Responsive Post Ad Links [previously link ad unit] -->\r\n<ins class=\"adsbygoogle\"\r\n     style=\"display:block\"\r\n     data-ad-client=\"ca-pub-3033787195489589\"\r\n     data-ad-slot=\"5456620019\"\r\n     data-ad-format=\"auto\"><\/ins>\r\n<script>\r\n     (adsbygoogle = window.adsbygoogle || []).push({});\r\n<\/script>\n<p>SSLyze is a stand-alone python application that looks for classic SSL misconfiguration, while providing the advanced user with the opportunity to customize the application via a simple plugin interface.<\/p>\n<p><strong>Features<\/strong><\/p>\n<ul>\n<li>    Insecure renegotiation testing<\/li>\n<li>    Scanning for weak strength ciphers<\/li>\n<li>    Checking for SSLv2, SSLv3 and TLSv1 versions<\/li>\n<li>    Server certificate information dump and basic validation<\/li>\n<li>    Session resumption capabilities and actual resumption rate measurement<\/li>\n<li>    Support for client certificate authentication<\/li>\n<li>    Simultaneous scanning of multiple servers, versions and ciphers<\/li>\n<\/ul>\n<p>For example, SSLyze can help user\u2019s identify server configurations vulnerable to <a href=\"https:\/\/www.darknet.org.uk\/2011\/10\/thc-ssl-dosddos-tool-released-for-download\/\">THC\u2019s recently released SSL DOS attack<\/a> by checking the server\u2019s support for client-initiated renegotiations. For more information on testing for client-initiated renegotiations, you can read <a href=\"http:\/\/code.google.com\/p\/sslyze\/wiki\/ThcSslDOS\">here<\/a>.<\/p>\n<p>You can download sslyze here:<\/p>\n<p><a href=\"http:\/\/sslyze.googlecode.com\/files\/sslyze-0.3_src.zip\">sslyze-0.3_src.zip<\/a><\/p>\n<p>Or read more <a href=\"http:\/\/code.google.com\/p\/sslyze\/\">here<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Transport Layer Security (TLS), commonly called SSL, is one of the most widely used protocols to secure network communications. As costs fall and user security and privacy expectations rise companies are deploying it more widely every year. Attacks against the CA system, SSL implementation flaws and aging protocol versions have grabbed news headlines, bringing attention [&hellip;]<\/p>\n","protected":false},"author":25,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_seopress_robots_primary_cat":"","_seopress_titles_title":"","_seopress_titles_desc":"","_seopress_robots_index":"","_genesis_hide_title":false,"_genesis_hide_breadcrumbs":false,"_genesis_hide_singular_image":false,"_genesis_hide_footer_widgets":false,"_genesis_custom_body_class":"","_genesis_custom_post_class":"","_genesis_layout":"","footnotes":""},"categories":[12,5,15],"tags":[3746,190,4583,7191,7194],"featured_image_src":null,"featured_image_src_square":null,"author_info":{"display_name":"Darknet","author_link":"https:\/\/www.darknet.org.uk\/author\/darknet\/"},"_links":{"self":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts\/3236"}],"collection":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/users\/25"}],"replies":[{"embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/comments?post=3236"}],"version-history":[{"count":0,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts\/3236\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/media?parent=3236"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/categories?post=3236"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/tags?post=3236"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}