Penetration Testing mailing list archives
RE: verify HTTPS 'vulnerabilities'
From: "Daniel Grzelak" <daniel.grzelak () sift com au>
Date: Fri, 22 Jul 2005 09:51:25 +1000
Dan, Get yourself a copy of openssl (cygwin based openssl works well on Windows). Using the command line client you can connect to the web server using a variety of ciphers/digests and even supply client certificates. In this way you can supply clear text input to verify whatever vulnerabilies nessus identified as well as test for which ciphers are allowed. A simple connection will look a little like this: openssl s_client -cert <mycert.pem> -cipher <CIPHER-XXX> -connect <10.0.0.0> A great tutorial on simple use of the tool is available here: http://www.madboa.com/geek/openssl/ Daniel Grzelak Associate SIFT www.sift.com.au "SIFT is a leading Australian information security consulting, intelligence and training firm. We specialise in the delivery of independent advice, reviews and recommendations to the senior management of large, highly-regulated organisations." -----Original Message----- From: Dan Rogers [mailto:pentestguy () gmail com] Sent: Friday, 22 July 2005 1:06 AM To: pen-test () securityfocus com Subject: verify HTTPS 'vulnerabilities' List, Simple question: I have a report from Nessus telling me that a web server is offering 'export class' cyphers for it's SSL/TLS service. Nessus also managed to obtain an internal IP address from the host (which is correct). Only HTTPS is open. However the target host requires basic authentication, and I don't have any credentials to obtain access. I would like to verify these manually, and would usually just use something like wfetch. However, I'm not getting the usual prompt that my encryption is too weak. Instead in the response I can see a message saying the page cannot be displayed. There is also no sign of the internal IP address. Can anyone tell me how they would prove that they are not false positives (I know the IP address is correct, but the client may want to replicate the vulnerability so they can be sure when they go to fix it)? thanks Dan
Current thread:
- verify HTTPS 'vulnerabilities' Dan Rogers (Jul 21)
- RE: verify HTTPS 'vulnerabilities' Daniel Grzelak (Jul 21)
- RE: verify HTTPS 'vulnerabilities' Omar Herrera (Jul 21)
- Re: verify HTTPS 'vulnerabilities' Thomas Springer (Jul 26)
- Re: verify HTTPS 'vulnerabilities' Michael Sierchio (Jul 26)
- <Possible follow-ups>
- RE: verify HTTPS 'vulnerabilities' Jarmon, Don R (Jul 21)
- RE: verify HTTPS 'vulnerabilities' Jordan Del-Grande (Jul 21)
- RE: verify HTTPS 'vulnerabilities' Carl (Jul 22)
- RE: verify HTTPS 'vulnerabilities' Todd Towles (Jul 26)