RE: verify HTTPS 'vulnerabilities'

["Jarmon, Don R" <Don.Jarmon () Intergraph com>]

You might try Foundstone's SSLDigger (free) to help verify.  It's provides a
detail report of actual ciphers used.  IMHO: Nessus only identifies surface
blemishes with web apps.

Don Jarmon - CISSP
Sr. Technical Consultant, Security Solutions
Security, Government & Infrastructure (SG&I) Division
Intergraph Corporation (NASDAQ:INGR)
Mail Stop 17C1
P.O. Box 6695, Huntsville, AL 35824 USA 
Don.Jarmon(at)Intergraph.com, solutions.intergraph.com

-----Original Message-----
From: Dan Rogers [mailto:pentestguy () gmail com] 
Sent: Thursday, July 21, 2005 10:06 AM
To: pen-test () securityfocus com
Subject: verify HTTPS 'vulnerabilities'

List,

Simple question:

I have a report from Nessus telling me that a web server is offering 'export
class' cyphers for it's SSL/TLS service. Nessus also managed to obtain an
internal IP address from the host (which is correct).
Only HTTPS is open.

However the target host requires basic authentication, and I don't have any
credentials to obtain access. I would like to verify these manually, and
would usually just use something like wfetch. However, I'm not getting the
usual prompt that my encryption is too weak.
Instead in the response I can see a message saying the page cannot be
displayed. There is also no sign of the internal IP address.

Can anyone tell me how they would prove that they are not false positives (I
know the IP address is correct, but the client may want to replicate the
vulnerability so they can be sure when they go to fix it)?

thanks

Dan