retour aux outils back to tools Ducklings

testssl.sh

Script complet de test SSL/TLS. Vérifie les ciphers faibles, les versions de protocole, les problèmes de certificats, BEAST, POODLE, Heartbleed, et plus de 100 autres vulnérabilités TLS. Comprehensive SSL/TLS testing script. Checks for weak ciphers, protocol versions, certificate issues, BEAST, POODLE, Heartbleed, and 100+ other TLS vulnerabilities.

↗ https://testssl.sh

Overview

testssl.sh is a free, open-source shell script that tests SSL/TLS configurations. It checks cipher strength, protocol versions, certificate validity, and 100+ known vulnerabilities (Heartbleed, POODLE, BEAST, DROWN, ROBOT, etc.) without requiring any external libraries beyond openssl.

Basic Usage

Full test against a host

testssl.sh target.com

Specific port

testssl.sh target.com:8443

# STARTTLS (mail server)
testssl.sh --starttls smtp mail.target.com:25
testssl.sh --starttls imap mail.target.com:143
testssl.sh --starttls ftp ftp.target.com:21

XMPP STARTTLS

testssl.sh --starttls xmpp jabber.target.com:5222

Targeted Tests

Only check protocols (SSLv2, SSLv3, TLS 1.0, 1.1, 1.2, 1.3)

testssl.sh --protocols target.com

Only check ciphers

testssl.sh --ciphers target.com

Only check certificate

testssl.sh --server-defaults target.com

# Check specific vulnerabilities only
testssl.sh --heartbleed target.com
testssl.sh --poodle target.com
testssl.sh --beast target.com
testssl.sh --robot target.com
testssl.sh --ticketbleed target.com

# Check all vulnerabilities
testssl.sh --vulnerable target.com
# or
testssl.sh -U target.com

Output & Reporting

HTML report

testssl.sh --htmlfile report.html target.com

JSON report

testssl.sh --jsonfile report.json target.com

Log file

testssl.sh --logfile results.log target.com

All formats at once

testssl.sh --htmlfile report.html --jsonfile report.json --csvfile report.csv target.com

testssl.sh --color 0 target.com   # No color (for piping)

testssl.sh --color 1 target.com   # ANSI colors

testssl.sh --color 3 target.com   # HTML colors

Batch Testing

Test multiple hosts from file

testssl.sh --file hosts.txt

# Format of hosts.txt:
# target.com
# mail.target.com:587 --starttls smtp
# api.target.com:8443

Important Findings to Look For

Protocol issues:
  ✗ SSLv2 / SSLv3    Obsolete, broken protocols
  ✗ TLS 1.0 / 1.1    Deprecated (PCI DSS compliance issue)
  ✓ TLS 1.2 / 1.3    Acceptable

Cipher issues:
  ✗ NULL / EXPORT     Trivially breakable
  ✗ RC4               Statistically weak
  ✗ DES / 3DES (SWEET32)  64-bit block cipher attacks
  ✗ Anonymous         No authentication
  ✗ AEAD ciphers OK   ✓ AESGCM, ChaCha20

Vulnerabilities:
  Heartbleed (CVE-2014-0160)  OpenSSL memory leak
  POODLE (CVE-2014-3566)       SSLv3 padding oracle
  DROWN (CVE-2016-0800)        SSLv2 cross-protocol attack
  BEAST (CVE-2011-3389)        TLS 1.0 CBC attack
  ROBOT (CVE-2017-1000385)     RSA PKCS#1 bleichenbacher
  LUCKY13 (CVE-2013-0169)      TLS CBC timing
  LOGJAM (CVE-2015-4000)       DHE downgrade

Tips

testssl.sh --sneaky uses a legitimate browser User-Agent to blend in
--parallel speeds up testing against multiple targets significantly
--severity HIGH filters output to only show high/critical issues
For PCI DSS assessments, specifically check TLS 1.0/1.1 are disabled

Help / Man page

testssl.sh [options] <URI>

Protocols:
  --protocols         Test all protocols
  --ssl2/--ssl3       Test specific version
  --tls1/--tls1_1/--tls1_2/--tls1_3

Ciphers:
  --ciphers           All ciphers
  --cipher-per-proto  Per protocol

Vulnerabilities:
  -U, --vulnerable    All vulnerabilities
  --heartbleed        CVE-2014-0160
  --poodle            CVE-2014-3566
  --beast             CVE-2011-3389
  --sweet32           CVE-2016-2183
  --robot             Bleichenbacher
  --logjam            CVE-2015-4000
  --drown             CVE-2016-0800
  --ticketbleed       CVE-2016-9244

Output:
  --htmlfile FILE     HTML report
  --jsonfile FILE     JSON report
  --csvfile FILE      CSV report
  --logfile FILE      Log file
  --severity LEVEL    LOW, MEDIUM, HIGH, CRITICAL
  --color 0/1/2/3     Color mode
  --sneaky            Use browser User-Agent

Misc:
  --starttls proto    STARTTLS (smtp, imap, ftp, xmpp...)
  --file FILE         Batch: hosts file
  --parallel          Parallel execution
  -t, --timeout N     Timeout

Vue d’ensemble

testssl.sh est un script shell gratuit et open source qui teste les configurations SSL/TLS. Il vérifie la robustesse des ciphers, les versions de protocole, la validité des certificats, et plus de 100 vulnérabilités connues (Heartbleed, POODLE, BEAST, DROWN, ROBOT, etc.) sans nécessiter de bibliothèque externe autre qu’openssl.

Utilisation de base

# Test complet contre un hôte
testssl.sh target.com

# Port spécifique
testssl.sh target.com:8443

# STARTTLS (serveur mail)
testssl.sh --starttls smtp mail.target.com:25
testssl.sh --starttls imap mail.target.com:143
testssl.sh --starttls ftp ftp.target.com:21

# XMPP STARTTLS
testssl.sh --starttls xmpp jabber.target.com:5222

Tests ciblés

# Ne vérifier que les protocoles (SSLv2, SSLv3, TLS 1.0, 1.1, 1.2, 1.3)
testssl.sh --protocols target.com

# Ne vérifier que les ciphers
testssl.sh --ciphers target.com

# Ne vérifier que le certificat
testssl.sh --server-defaults target.com

# Vérifier des vulnérabilités spécifiques uniquement
testssl.sh --heartbleed target.com
testssl.sh --poodle target.com
testssl.sh --beast target.com
testssl.sh --robot target.com
testssl.sh --ticketbleed target.com

# Vérifier toutes les vulnérabilités
testssl.sh --vulnerable target.com
# ou
testssl.sh -U target.com

Sortie et rapports

# Rapport HTML
testssl.sh --htmlfile report.html target.com

# Rapport JSON
testssl.sh --jsonfile report.json target.com

# Fichier journal
testssl.sh --logfile results.log target.com

# Tous les formats en une fois
testssl.sh --htmlfile report.html --jsonfile report.json --csvfile report.csv target.com

# Pas de couleur (pour le piping)
testssl.sh --color 0 target.com

# Couleurs ANSI
testssl.sh --color 1 target.com

# Couleurs HTML
testssl.sh --color 3 target.com

Test par lot

# Tester plusieurs hôtes depuis un fichier
testssl.sh --file hosts.txt

# Format de hosts.txt :
# target.com
# mail.target.com:587 --starttls smtp
# api.target.com:8443

Résultats importants à surveiller

Protocol issues:
  ✗ SSLv2 / SSLv3    Obsolete, broken protocols
  ✗ TLS 1.0 / 1.1    Deprecated (PCI DSS compliance issue)
  ✓ TLS 1.2 / 1.3    Acceptable

Cipher issues:
  ✗ NULL / EXPORT     Trivially breakable
  ✗ RC4               Statistically weak
  ✗ DES / 3DES (SWEET32)  64-bit block cipher attacks
  ✗ Anonymous         No authentication
  ✗ AEAD ciphers OK   ✓ AESGCM, ChaCha20

Vulnerabilities:
  Heartbleed (CVE-2014-0160)  OpenSSL memory leak
  POODLE (CVE-2014-3566)       SSLv3 padding oracle
  DROWN (CVE-2016-0800)        SSLv2 cross-protocol attack
  BEAST (CVE-2011-3389)        TLS 1.0 CBC attack
  ROBOT (CVE-2017-1000385)     RSA PKCS#1 bleichenbacher
  LUCKY13 (CVE-2013-0169)      TLS CBC timing
  LOGJAM (CVE-2015-4000)       DHE downgrade

Conseils

testssl.sh --sneaky utilise un User-Agent de navigateur légitime pour se fondre dans le trafic normal
--parallel accélère nettement le test contre plusieurs cibles
--severity HIGH filtre la sortie pour ne montrer que les problèmes high/critical
Pour les audits PCI DSS, vérifier spécifiquement que TLS 1.0/1.1 sont désactivés

Aide / Page de manuel

testssl.sh [options] <URI>

Protocols:
  --protocols         Test all protocols
  --ssl2/--ssl3       Test specific version
  --tls1/--tls1_1/--tls1_2/--tls1_3

Ciphers:
  --ciphers           All ciphers
  --cipher-per-proto  Per protocol

Vulnerabilities:
  -U, --vulnerable    All vulnerabilities
  --heartbleed        CVE-2014-0160
  --poodle            CVE-2014-3566
  --beast             CVE-2011-3389
  --sweet32           CVE-2016-2183
  --robot             Bleichenbacher
  --logjam            CVE-2015-4000
  --drown             CVE-2016-0800
  --ticketbleed       CVE-2016-9244

Output:
  --htmlfile FILE     HTML report
  --jsonfile FILE     JSON report
  --csvfile FILE      CSV report
  --logfile FILE      Log file
  --severity LEVEL    LOW, MEDIUM, HIGH, CRITICAL
  --color 0/1/2/3     Color mode
  --sneaky            Use browser User-Agent

Misc:
  --starttls proto    STARTTLS (smtp, imap, ftp, xmpp...)
  --file FILE         Batch: hosts file
  --parallel          Parallel execution
  -t, --timeout N     Timeout