API tools faq
paste
Advertisement
Guest User

Untitled

a guest
Aug 17th, 2016
301
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 10.12 KB | None | 0 0
raw download clone embed print report
  1. ###########################################################
  2. testssl.sh 2.8rc1 from https://testssl.sh/dev/
  3. (424cf23 2016-08-09 10:35:58 -- 1.531)
  4.  
  5. This program is free software. Distribution and
  6. modification under GPLv2 permitted.
  7. USAGE w/o ANY WARRANTY. USE IT AT YOUR OWN RISK!
  8.  
  9. Please file bugs @ https://testssl.sh/bugs/
  10.  
  11. ###########################################################
  12.  
  13. Using "OpenSSL 1.0.2-chacha (1.0.2i-dev)" [~183 ciphers]
  14. on a006:./bin/openssl.Linux.x86_64
  15. (built: "Jun 22 19:32:29 2016", platform: "linux-x86_64")
  16.  
  17.  
  18. Start 2016-08-17 21:32:36 -->> 192.168.1.1:443 (r7) <<--
  19.  
  20. rDNS (192.168.1.1):
  21. Service detected: HTTP
  22.  
  23.  
  24. Testing protocols (via sockets except TLS 1.2, SPDY+HTTP2)
  25.  
  26. SSLv2 not offered (OK)
  27. SSLv3 not offered (OK)
  28. TLS 1 offered
  29. TLS 1.1 offered
  30. TLS 1.2 offered (OK)
  31. Version tolerance downgraded to TLSv1.2 (OK)
  32. SPDY/NPN not offered
  33. HTTP2/ALPN not offered
  34.  
  35. Testing ~standard cipher lists
  36.  
  37. Null Ciphers not offered (OK)
  38. Anonymous NULL Ciphers not offered (OK)
  39. Anonymous DH Ciphers not offered (OK)
  40. 40 Bit encryption not offered (OK)
  41. 56 Bit encryption not offered (OK)
  42. Export Ciphers (general) not offered (OK)
  43. Low (<=64 Bit) not offered (OK)
  44. DES Ciphers not offered (OK)
  45. Medium grade encryption not offered (OK)
  46. Triple DES Ciphers offered
  47. High grade encryption offered (OK)
  48.  
  49.  
  50. Testing robust (perfect) forward secrecy, (P)FS -- omitting Null Authentication/Encryption as well as 3DES and RC4 here
  51.  
  52. PFS is offered (OK) ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES128-SHA ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA384 ECDHE-RSA-AES256-SHA
  53. Elliptic curves offered: prime256v1
  54.  
  55.  
  56. Testing server preferences
  57.  
  58. Has server cipher order? yes (OK)
  59. Negotiated protocol TLSv1.2
  60. Negotiated cipher ECDHE-RSA-AES128-GCM-SHA256, 256 bit ECDH
  61. Cipher order
  62. TLSv1: ECDHE-RSA-AES128-SHA ECDHE-RSA-AES256-SHA AES128-SHA AES256-SHA DES-CBC3-SHA
  63. TLSv1.1: ECDHE-RSA-AES128-SHA ECDHE-RSA-AES256-SHA AES128-SHA AES256-SHA DES-CBC3-SHA
  64. TLSv1.2: ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES128-SHA ECDHE-RSA-AES256-SHA384 ECDHE-RSA-AES256-SHA AES128-GCM-SHA256 AES256-GCM-SHA384 AES128-SHA256 AES256-SHA256 AES128-SHA AES256-SHA DES-CBC3-SHA
  65.  
  66.  
  67. Testing server defaults (Server Hello)
  68.  
  69. TLS extensions (standard) "renegotiation info/#65281" "EC point formats/#11" "session ticket/#35" "heartbeat/#15"
  70. Session Tickets RFC 5077 300 seconds (PFS requires session ticket keys to be rotated <= daily)
  71. SSL Session ID support yes
  72. TLS clock skew random values, no fingerprinting possible
  73. Signature Algorithm SHA1 with RSA
  74. Server key size RSA 2048 bits
  75. Fingerprint / Serial SHA1 8CA67181742164606AF4130C1CAD2800DB811C05 / ADE768238EFA7326
  76. SHA256 185D3F08D1F6EF23E9B5447995D7311253B60F48B202CBC547E022FCCB60A788
  77. Common Name (CN) "NewMedia-NET GmbH"
  78. subjectAltName (SAN) --
  79. Issuer self-signed (NOT ok)
  80. Trust (hostname) certificate does not match supplied URI
  81. Chain of trust NOT ok (self signed)
  82. EV cert (experimental) no
  83. Certificate Expiration 3648 >= 60 days (2016-08-16 03:35 --> 2026-08-14 03:35 -0700)
  84. # of certificates provided 1
  85. Certificate Revocation List --
  86. OCSP URI --
  87. OCSP stapling --
  88.  
  89.  
  90. Testing HTTP header response @ "/"
  91.  
  92. HTTP Status Code 401 Unauthorized WWW-Authenticate: Basic realm="r7"
  93. HTTP clock skew 0 sec from localtime
  94. Strict Transport Security --
  95. Public Key Pinning --
  96. Server banner httpd
  97. Application banner --
  98. Cookie(s) (none issued at "/")
  99. Security headers --
  100. Reverse Proxy banner --
  101.  
  102.  
  103. Testing vulnerabilities
  104.  
  105. Heartbleed (CVE-2014-0160) not vulnerable (OK)
  106. CCS (CVE-2014-0224) not vulnerable (OK)
  107. Secure Renegotiation (CVE-2009-3555) not vulnerable (OK)
  108. Secure Client-Initiated Renegotiation VULNERABLE (NOT ok), DoS threat
  109. CRIME, TLS (CVE-2012-4929) VULNERABLE (NOT ok)
  110. BREACH (CVE-2013-3587) no HTTP compression (OK) - only supplied "/" tested
  111. POODLE, SSL (CVE-2014-3566) not vulnerable (OK)
  112. TLS_FALLBACK_SCSV (RFC 7507), experim. Downgrade attack prevention supported (OK)
  113. FREAK (CVE-2015-0204) not vulnerable (OK)
  114. DROWN (2016-0800, CVE-2016-0703), exper. not vulnerable on this port (OK)
  115. make sure you don't use this certificate elsewhere with SSLv2 enabled services
  116. https://censys.io/ipv4?q=185D3F08D1F6EF23E9B5447995D7311253B60F48B202CBC547E022FCCB60A788 could help you to find out
  117. LOGJAM (CVE-2015-4000), experimental not vulnerable (OK), common primes not checked. See below for any DH ciphers + bit size
  118. BEAST (CVE-2011-3389) TLS1: DES-CBC3-SHA AES128-SHA
  119. AES256-SHA ECDHE-RSA-AES128-SHA ECDHE-RSA-AES256-SHA
  120. VULNERABLE -- but also supports higher protocols (possible mitigation): TLSv1.1 TLSv1.2
  121. RC4 (CVE-2013-2566, CVE-2015-2808) no RC4 ciphers detected (OK)
  122.  
  123.  
  124. Testing all 183 locally available ciphers against the server, ordered by encryption strength
  125.  
  126. Hexcode Cipher Suite Name (OpenSSL) KeyExch. Encryption Bits Cipher Suite Name (RFC)
  127. ---------------------------------------------------------------------------------------------------------------------------
  128. xc030 ECDHE-RSA-AES256-GCM-SHA384 ECDH 256 AESGCM 256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
  129. xc028 ECDHE-RSA-AES256-SHA384 ECDH 256 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
  130. xc014 ECDHE-RSA-AES256-SHA ECDH 256 AES 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
  131. x9d AES256-GCM-SHA384 RSA AESGCM 256 TLS_RSA_WITH_AES_256_GCM_SHA384
  132. x3d AES256-SHA256 RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA256
  133. x35 AES256-SHA RSA AES 256 TLS_RSA_WITH_AES_256_CBC_SHA
  134. xc02f ECDHE-RSA-AES128-GCM-SHA256 ECDH 256 AESGCM 128 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
  135. xc027 ECDHE-RSA-AES128-SHA256 ECDH 256 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
  136. xc013 ECDHE-RSA-AES128-SHA ECDH 256 AES 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
  137. x9c AES128-GCM-SHA256 RSA AESGCM 128 TLS_RSA_WITH_AES_128_GCM_SHA256
  138. x3c AES128-SHA256 RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA256
  139. x2f AES128-SHA RSA AES 128 TLS_RSA_WITH_AES_128_CBC_SHA
  140. x0a DES-CBC3-SHA RSA 3DES 168 TLS_RSA_WITH_3DES_EDE_CBC_SHA
  141.  
  142.  
  143. Running browser simulations via sockets (experimental)
  144.  
  145. Android 2.3.7 TLSv1.0 AES128-SHA
  146. Android 4.0.4 TLSv1.0 ECDHE-RSA-AES128-SHA
  147. Android 4.1.1 TLSv1.0 ECDHE-RSA-AES128-SHA
  148. Android 4.2.2 TLSv1.0 ECDHE-RSA-AES128-SHA
  149. Android 4.3 TLSv1.0 ECDHE-RSA-AES128-SHA
  150. Android 4.4.2 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256
  151. Android 5.0.0 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256
  152. Baidu Jan 2015 TLSv1.0 ECDHE-RSA-AES128-SHA
  153. BingPreview Jan 2015 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256
  154. Chrome 47 / OSX TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256
  155. Firefox 31.3.0ESR / Win7 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256
  156. Firefox 42 OS X TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256
  157. GoogleBot Feb 2015 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256
  158. IE 6 XP No connection
  159. IE 7 Vista TLSv1.0 ECDHE-RSA-AES128-SHA
  160. IE 8 XP TLSv1.0 DES-CBC3-SHA
  161. IE 8-10 Win 7 TLSv1.0 ECDHE-RSA-AES128-SHA
  162. IE 11 Win 7 TLSv1.2 ECDHE-RSA-AES128-SHA256
  163. IE 11 Win 8.1 TLSv1.2 ECDHE-RSA-AES128-SHA256
  164. IE 10 Win Phone 8.0 TLSv1.0 ECDHE-RSA-AES128-SHA
  165. IE 11 Win Phone 8.1 TLSv1.2 ECDHE-RSA-AES128-SHA256
  166. IE 11 Win Phone 8.1 Update TLSv1.2 ECDHE-RSA-AES128-SHA256
  167. IE 11 Win 10 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256
  168. Edge 13 Win 10 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256
  169. Edge 13 Win Phone 10 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256
  170. Java 6u45 TLSv1.0 AES128-SHA
  171. Java 7u25 TLSv1.0 ECDHE-RSA-AES128-SHA
  172. Java 8u31 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256
  173. OpenSSL 0.9.8y TLSv1.0 AES128-SHA
  174. OpenSSL 1.0.1l TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256
  175. OpenSSL 1.0.2e TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256
  176. Safari 5.1.9 OS X 10.6.8 TLSv1.0 ECDHE-RSA-AES128-SHA
  177. Safari 6 iOS 6.0.1 TLSv1.2 ECDHE-RSA-AES128-SHA256
  178. Safari 6.0.4 OS X 10.8.4 TLSv1.0 ECDHE-RSA-AES128-SHA
  179. Safari 7 iOS 7.1 TLSv1.2 ECDHE-RSA-AES128-SHA256
  180. Safari 7 OS X 10.9 TLSv1.2 ECDHE-RSA-AES128-SHA256
  181. Safari 8 iOS 8.4 TLSv1.2 ECDHE-RSA-AES128-SHA256
  182. Safari 8 OS X 10.10 TLSv1.2 ECDHE-RSA-AES128-SHA256
  183. Safari 9 iOS 9 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256
  184. Safari 9 OS X 10.11 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!