search

drwetter / testssl.sh

Testing TLS/SSL encryption anywhere on any port
https://testssl.sh
GNU General Public License v2.0
7.95k stars 1.02k forks source link

[BUG] Secure Client-Initiated Renegotiation test does not detect exponential renegotiation backoff mitigation. #2444

Closed Tazmaniac closed 9 months ago

Tazmaniac commented 10 months ago

testssl.sh 3.2 branch

Command line / docker command to reproduce ASSUME_HTTP=true testssl.sh -R https://target.fr (targets to reproduce available on request)

Expected behavior "not vulnerable (OK) -- mitigated" result.

The target is using exponential backoff/throttling between each renegotiation tries. testssl.sh has no provision to detect this mitigation (compared to the python tool sslyze) and give false positive.

Here is a proposition of a simple approach to fix this: #2443

Replaced by this PR with more fixes/enhancements https://github.com/drwetter/testssl.sh/pull/2459

drwetter commented 10 months ago

Thanks! Do you have one or two examples for a target for me?