search

konklone / shaaaaaaaaaaaaa

Check if a website has weak SHA-1 TLS certificates.
https://shaaaaaaaaaaaaa.com
BSD 3-Clause "New" or "Revised" License
207 stars 27 forks source link

Hopefully numbers in domains are left alone (fix issue#62) #63

Closed jonnybarnes closed 9 years ago

jonnybarnes commented 9 years ago

Can someone double check the regex here. I was just messing around on regex101.com getting this to work.

konklone commented 9 years ago

Could you give me a domain that's having problems? I didn't see one mentioned in #62 either.

To accept this, we need a new test in test/shaaaaa.js, using a real-world domain, that would fail under what's in the master branch right now, but which passes in this PR's branch.

jonnybarnes commented 9 years ago

The domain in question, the site still being under development, is teacup.p3k.io. The original regex removed the three meaning shaaaa was running the command openssl s_client -connect teacup.p3k.io:443 -servername teacup.pk.io -showcerts. Seeing as the server doesn't have a vhost for teacup.pk.io it was falling back to giving us a default cert for an unrelated domain it also hosted.

konklone commented 9 years ago

Got it. I just verified what you were seeing, and added a test in 35d8183 for teacup.p3k.io, that fails on master and works in this PR.

We had an existing test with a domain with a number in it, individual8.com, but that domain wasn't using SNI and so the -servername flag wasn't relevant to the server's response.

Thanks for catching this! Deploying it now.