← retour aux outils back to tools

# testssl.sh

Script complet de test SSL/TLS. Vérifie les ciphers faibles, les versions de protocole, les problèmes de certificats, BEAST, POODLE, Heartbleed, et plus de 100 autres vulnérabilités TLS. Comprehensive SSL/TLS testing script. Checks for weak ciphers, protocol versions, certificate issues, BEAST, POODLE, Heartbleed, and 100+ other TLS vulnerabilities.

↗ https://testssl.sh

## Overview

testssl.sh is a free, open-source shell script that tests SSL/TLS configurations. It checks cipher strength, protocol versions, certificate validity, and 100+ known vulnerabilities (Heartbleed, POODLE, BEAST, DROWN, ROBOT, etc.) without requiring any external libraries beyond openssl.

## Basic Usage

Full test against a host

    testssl.sh target.com

Specific port

    testssl.sh target.com:8443

    # STARTTLS (mail server)
    testssl.sh --starttls smtp mail.target.com:25
    testssl.sh --starttls imap mail.target.com:143
    testssl.sh --starttls ftp ftp.target.com:21

XMPP STARTTLS

    testssl.sh --starttls xmpp jabber.target.com:5222

## Targeted Tests

Only check protocols (SSLv2, SSLv3, TLS 1.0, 1.1, 1.2, 1.3)

    testssl.sh --protocols target.com

Only check ciphers

    testssl.sh --ciphers target.com

Only check certificate

    testssl.sh --server-defaults target.com

    # Check specific vulnerabilities only
    testssl.sh --heartbleed target.com
    testssl.sh --poodle target.com
    testssl.sh --beast target.com
    testssl.sh --robot target.com
    testssl.sh --ticketbleed target.com

    # Check all vulnerabilities
    testssl.sh --vulnerable target.com
    # or
    testssl.sh -U target.com

## Output & Reporting

HTML report

    testssl.sh --htmlfile report.html target.com

JSON report

    testssl.sh --jsonfile report.json target.com

Log file

    testssl.sh --logfile results.log target.com

All formats at once

    testssl.sh --htmlfile report.html --jsonfile report.json --csvfile report.csv target.com

    testssl.sh --color 0 target.com   # No color (for piping)

    testssl.sh --color 1 target.com   # ANSI colors

    testssl.sh --color 3 target.com   # HTML colors

## Batch Testing

Test multiple hosts from file

    testssl.sh --file hosts.txt

    # Format of hosts.txt:
    # target.com
    # mail.target.com:587 --starttls smtp
    # api.target.com:8443

## Important Findings to Look For

    Protocol issues:
      ✗ SSLv2 / SSLv3    Obsolete, broken protocols
      ✗ TLS 1.0 / 1.1    Deprecated (PCI DSS compliance issue)
      ✓ TLS 1.2 / 1.3    Acceptable

    Cipher issues:
      ✗ NULL / EXPORT     Trivially breakable
      ✗ RC4               Statistically weak
      ✗ DES / 3DES (SWEET32)  64-bit block cipher attacks
      ✗ Anonymous         No authentication
      ✗ AEAD ciphers OK   ✓ AESGCM, ChaCha20

    Vulnerabilities:
      Heartbleed (CVE-2014-0160)  OpenSSL memory leak
      POODLE (CVE-2014-3566)       SSLv3 padding oracle
      DROWN (CVE-2016-0800)        SSLv2 cross-protocol attack
      BEAST (CVE-2011-3389)        TLS 1.0 CBC attack
      ROBOT (CVE-2017-1000385)     RSA PKCS#1 bleichenbacher
      LUCKY13 (CVE-2013-0169)      TLS CBC timing
      LOGJAM (CVE-2015-4000)       DHE downgrade

## Tips

- `testssl.sh --sneaky` uses a legitimate browser User-Agent to blend in
- `--parallel` speeds up testing against multiple targets significantly
- `--severity HIGH` filters output to only show high/critical issues
- For PCI DSS assessments, specifically check TLS 1.0/1.1 are disabled

Help / Man page

    testssl.sh [options] <URI>

    Protocols:
      --protocols         Test all protocols
      --ssl2/--ssl3       Test specific version
      --tls1/--tls1_1/--tls1_2/--tls1_3

    Ciphers:
      --ciphers           All ciphers
      --cipher-per-proto  Per protocol

    Vulnerabilities:
      -U, --vulnerable    All vulnerabilities
      --heartbleed        CVE-2014-0160
      --poodle            CVE-2014-3566
      --beast             CVE-2011-3389
      --sweet32           CVE-2016-2183
      --robot             Bleichenbacher
      --logjam            CVE-2015-4000
      --drown             CVE-2016-0800
      --ticketbleed       CVE-2016-9244

    Output:
      --htmlfile FILE     HTML report
      --jsonfile FILE     JSON report
      --csvfile FILE      CSV report
      --logfile FILE      Log file
      --severity LEVEL    LOW, MEDIUM, HIGH, CRITICAL
      --color 0/1/2/3     Color mode
      --sneaky            Use browser User-Agent

    Misc:
      --starttls proto    STARTTLS (smtp, imap, ftp, xmpp...)
      --file FILE         Batch: hosts file
      --parallel          Parallel execution
      -t, --timeout N     Timeout

## Vue d’ensemble

testssl.sh est un script shell gratuit et open source qui teste les configurations SSL/TLS. Il vérifie la robustesse des ciphers, les versions de protocole, la validité des certificats, et plus de 100 vulnérabilités connues (Heartbleed, POODLE, BEAST, DROWN, ROBOT, etc.) sans nécessiter de bibliothèque externe autre qu’openssl.

## Utilisation de base

    # Test complet contre un hôte
    testssl.sh target.com

    # Port spécifique
    testssl.sh target.com:8443

    # STARTTLS (serveur mail)
    testssl.sh --starttls smtp mail.target.com:25
    testssl.sh --starttls imap mail.target.com:143
    testssl.sh --starttls ftp ftp.target.com:21

    # XMPP STARTTLS
    testssl.sh --starttls xmpp jabber.target.com:5222

## Tests ciblés

    # Ne vérifier que les protocoles (SSLv2, SSLv3, TLS 1.0, 1.1, 1.2, 1.3)
    testssl.sh --protocols target.com

    # Ne vérifier que les ciphers
    testssl.sh --ciphers target.com

    # Ne vérifier que le certificat
    testssl.sh --server-defaults target.com

    # Vérifier des vulnérabilités spécifiques uniquement
    testssl.sh --heartbleed target.com
    testssl.sh --poodle target.com
    testssl.sh --beast target.com
    testssl.sh --robot target.com
    testssl.sh --ticketbleed target.com

    # Vérifier toutes les vulnérabilités
    testssl.sh --vulnerable target.com
    # ou
    testssl.sh -U target.com

## Sortie et rapports

    # Rapport HTML
    testssl.sh --htmlfile report.html target.com

    # Rapport JSON
    testssl.sh --jsonfile report.json target.com

    # Fichier journal
    testssl.sh --logfile results.log target.com

    # Tous les formats en une fois
    testssl.sh --htmlfile report.html --jsonfile report.json --csvfile report.csv target.com

    # Pas de couleur (pour le piping)
    testssl.sh --color 0 target.com

    # Couleurs ANSI
    testssl.sh --color 1 target.com

    # Couleurs HTML
    testssl.sh --color 3 target.com

## Test par lot

    # Tester plusieurs hôtes depuis un fichier
    testssl.sh --file hosts.txt

    # Format de hosts.txt :
    # target.com
    # mail.target.com:587 --starttls smtp
    # api.target.com:8443

## Résultats importants à surveiller

    Protocol issues:
      ✗ SSLv2 / SSLv3    Obsolete, broken protocols
      ✗ TLS 1.0 / 1.1    Deprecated (PCI DSS compliance issue)
      ✓ TLS 1.2 / 1.3    Acceptable

    Cipher issues:
      ✗ NULL / EXPORT     Trivially breakable
      ✗ RC4               Statistically weak
      ✗ DES / 3DES (SWEET32)  64-bit block cipher attacks
      ✗ Anonymous         No authentication
      ✗ AEAD ciphers OK   ✓ AESGCM, ChaCha20

    Vulnerabilities:
      Heartbleed (CVE-2014-0160)  OpenSSL memory leak
      POODLE (CVE-2014-3566)       SSLv3 padding oracle
      DROWN (CVE-2016-0800)        SSLv2 cross-protocol attack
      BEAST (CVE-2011-3389)        TLS 1.0 CBC attack
      ROBOT (CVE-2017-1000385)     RSA PKCS#1 bleichenbacher
      LUCKY13 (CVE-2013-0169)      TLS CBC timing
      LOGJAM (CVE-2015-4000)       DHE downgrade

## Conseils

- `testssl.sh --sneaky` utilise un User-Agent de navigateur légitime pour se fondre dans le trafic normal
- `--parallel` accélère nettement le test contre plusieurs cibles
- `--severity HIGH` filtre la sortie pour ne montrer que les problèmes high/critical
- Pour les audits PCI DSS, vérifier spécifiquement que TLS 1.0/1.1 sont désactivés

Aide / Page de manuel

    testssl.sh [options] <URI>

    Protocols:
      --protocols         Test all protocols
      --ssl2/--ssl3       Test specific version
      --tls1/--tls1_1/--tls1_2/--tls1_3

    Ciphers:
      --ciphers           All ciphers
      --cipher-per-proto  Per protocol

    Vulnerabilities:
      -U, --vulnerable    All vulnerabilities
      --heartbleed        CVE-2014-0160
      --poodle            CVE-2014-3566
      --beast             CVE-2011-3389
      --sweet32           CVE-2016-2183
      --robot             Bleichenbacher
      --logjam            CVE-2015-4000
      --drown             CVE-2016-0800
      --ticketbleed       CVE-2016-9244

    Output:
      --htmlfile FILE     HTML report
      --jsonfile FILE     JSON report
      --csvfile FILE      CSV report
      --logfile FILE      Log file
      --severity LEVEL    LOW, MEDIUM, HIGH, CRITICAL
      --color 0/1/2/3     Color mode
      --sneaky            Use browser User-Agent

    Misc:
      --starttls proto    STARTTLS (smtp, imap, ftp, xmpp...)
      --file FILE         Batch: hosts file
      --parallel          Parallel execution
      -t, --timeout N     Timeout