Findings for Sslyze

[aronmolnar]

In the course of restructuring uploaded notes, I will also improve the pushing of Sslyze findings.

• All pushed findings should be aggregated for multiple targets (e. g. only one finding for multiple systems with untrusted certificate)
• The following findings should be created:
  • Issues affecting the certificate (untrusted, SHA1, etc.)
  • Issues affecting web server configuration (misconfigurations, insecure protocols and ciphers)
  • SSL vulnerabilities

[noraj]

In case it could help you, some years ago I wrote tls-map that can map TLS cipher algorithm names between IANA, OpenSSL, GnuTLS, NSS but also extract cipher suites from external tools: SSLyze, sslscan2, testssl.sh, ssllabs-scan, tlsx (and a bunch of other stuff.

Example of extraction: https://noraj.github.io/tls-map/#/pages/examples?id=extract, commands: https://noraj.github.io/tls-map/yard/TLSmap/App/Extractor

Code for extraction: https://github.com/noraj/tls-map/blob/master/lib/tls_map/app/extractor/extractor.rb

I know my code is un Ruby and Reptor in Python but this could inspire you.

[aronmolnar]

Ah that's very nice - thanks.

Unfortunately I have done this part already. I used data from https://ciphersuite.info/

[noraj]

I does that too to retrieve which cipher suite is weak https://github.com/noraj/tls-map/blob/master/lib/tls_map/app/extended/ciphersuiteinfo.rb