- OWASP SSL advanced forensic tool / OWASP SSL audit for testers
O-Saft is an easy to use tool to show informations about SSL certificate and tests the SSL connection according given list of ciphers and various SSL configurations.
It's designed to be used by penetration testers, security auditors or server administrators. The idea is to show the important informations or the special checks with a simple call of the tool. However, it provides a wide range of options so that it can be used for comprehensive and special checks by experienced people.
O-Saft is a command-line tool, so it can be used offline and in closed environments. There is also a GUI based on Tcl/Tk. However, it can simply be turned into an online CGI-tool (please read documentation first).
Introduction
- Quick Installation:
- Download and unpack o-saft.tgz (Stable Release)
- to run o-saft: Ensure that following perl modules (and their dependencies) are installed
- IO::Socket::INET, IO::Socket::SSL, Net::SSLeay
- Net::SSLinfo, Net::SSLhello (which are part of the tarball)
- read and (re-)move o-saft-README
- Show help
- o-saft --help=commands
- o-saft --help
- o-saft +info your.tld
- o-saft +check your.tld
- o-saft +quick your.tld
- o-saft +cipherall your.tld
- o-saft +cipherall --starttls=pop3 pop3.your.tld:110
- o-saft +info mail.tld:25 --starttls
- to run the optional checkAllCiphers (tiny program to check solely ciphers, like command '+cipherall'): It usually does not need any perl module to be additionally installed
- Socket (should be part of your perl installation)
- Net::SSLhello (which is part of the tarball)
- NET::DNS (only needed, if option '--mx' is used)
- checkAllCiphers your.tld
- checkAllCiphers --starttls=pop3 pop3.your.tld:110
- checkAllCiphers --mx your.tld:25 --starttls=smtp
- o-saft.tcl
- o-saft.tcl your.tld
- apt install o-saft # installs version 19.01.19
- apt install libidn11-dev libidn2-0-dev libzip-dev libsctp-dev libkrb5-dev
- cd /usr/share/o-saft
- # get updated script
- curl -O contrib/install_openssl.sh https://raw.githubusercontent.com/OWASP/O-Saft/master/contrib/install_openssl.sh
- sh contrib/install_openssl.sh --m
- # enjoy commands as described before ...
Description
The main idea is to have a tool which works on common platforms and can simply be automated.
- In a Nutshell:
:* show SSL connection details
:* show certificate details
:* check for supported ciphers
:* check for ciphers provided in your own libssl.so and libcrypt.so
:* check for ciphers without any dependency to a library (+cipherall)
:* checks the server's priority for ciphers (+cipherall)
:* check for special HTTP(S) support (like SNI, HSTS, certificate pinning, SSTP)
:* check for vulnerabilities (BEAST, CRIME, DROWN, FREAK, Heartbleed, Lucky 13, POODLE, RC4 Bias, Sweet32 ...)
:* check the length of Diffie Hellman Parameters by the cipher (+cipherall needs option '--experimental')
:* may check for a single attribute
:* may check multiple targets at once
:* can be scripted (headless or as CGI)
:* should work on any platform (just needs perl, openssl optional)
:* can be used in CI / CD environments
:* output format can be customized
:* various trace and debug options to hunt unusual connection problems
:* supports STARTTLS for various protocols like (SMTP, POP3, IMAP, LDAP, RDP, XMPP, IRC (experimental) ...),[without options using openssl]
slows down to prevent blockades of requests due to too much connections (supported for some protocols like SMTP)
:* Proxy is supported (besides commands using openssl)
:* check of STARTTLS/SMTP for all servers of a MX Resource Record (e.g. checkAllCiphers --mx your.tld:25 --starttls=smtp)
:* checkAllCiphers.pl and '+cipherall' support DTLS for '--experimental' use (if records are *not* fragmented)
New Features of Test Version
- Quick Installation (test version):
- Download and unpack: master.zip
- Start INSTALL.sh (if you want:)
- Enjoy new functionality:
:* --starttls='CUSTOM' to customize your own STARTTLS sequence including error handling, see help for '--starttls_phase1..5' and '--starttls_error1..3'
:* '+cipherraw' and 'checkAllCiphers.pl' changed bahavior to check sni (now the default is to use solely sni >=tls1,
new option --togglesni tests without and with sni in one call
:* checkAllCiphers.pl/+cipherall: shows the length of dh_parameter for ciphers with DHE and DH_anon, shows the elliptic curve that the server prefers for ECDHE (independant from openssl)
:* checkAllCiphers.pl/+cipherall: support of fagmented messages reassembling SSL/TLS-records
</td>
What is O-Saft?
O-Saft provides:
O-Saft provides:
- SSL connection details
- SSL connection details
- certificate details
- certificate details
- full cipher check
- full cipher check
- special HTTP(s) checks
- special HTTP(s) checks
- check for SSL vulnerabilities
- check for SSL vulnerabilities
- can be scripted
- can be scripted
- platfrom independent
- platfrom independent
- customizable output
- customizable output
- supports STARTTLS and Proxy (for most commands)
- supports STARTTLS and Proxy (for most commands)
Screen Shots
Screen Shots
Documentation
Documentation
- <a href="O-Saft/Documentation" title=>help/man page</a>
- <a href="O-Saft/Documentation" title=>help/man page</a>
Presentations
Presentations
- There will be a training <a href="BeNeLux_OWASP_Day_2016#Trainingday" title=>O-Saft - TLS/SSL in Practice</a>.
- There will be a training <a href="BeNeLux_OWASP_Day_2016#Trainingday" title=>O-Saft - TLS/SSL in Practice</a>.
- There will be a training TLS/SSL in Practice which in particular covers O-Saft.
- There will be a training TLS/SSL in Practice which in particular covers O-Saft.
- 09.12.2014 Presentation '' Richtig verschlüsseln mit SSL/TLS'' at <a href="German_OWASP_Day_2014" title=>German OWASP Day 2014</a>, program see <a href="German_OWASP_Day_2014/Programm" title=>here</a>
- 09.12.2014 Presentation '' Richtig verschlüsseln mit SSL/TLS'' at <a href="German_OWASP_Day_2014" title=>German OWASP Day 2014</a>, program see <a href="German_OWASP_Day_2014/Programm" title=>here</a>
- AppSecEU 2014, Cambridge
- AppSecEU 2014, Cambridge
- There will be a training TLS/SSL in Practice which in particular covers O-Saft. For schedule see here.
- There will be a training TLS/SSL in Practice which in particular covers O-Saft. For schedule see here.
- Vortrag beim German OWASP Day 2014: <a href="/www-pdf-archive/Richtig_verschluesseln_mit_SSL+TLS_-_Achim_Hoffmann+Torsten_Gigler.pdf" title=>Richtig verschlüsseln mit SSL/TLS</a>
- Vortrag beim German OWASP Day 2014: <a href="/www-pdf-archive/Richtig_verschluesseln_mit_SSL+TLS_-_Achim_Hoffmann+Torsten_Gigler.pdf" title=>Richtig verschlüsseln mit SSL/TLS</a>
- Vortrag beim Münchner OWASP-Stammtisch: <a href="/www-pdf-archive/SSL-in-der-Praxis_OWASP-Stammtisch-Muenchen.pdf" title=>Überblick über aktuelle Angriffsmöglichkeiten auf HTTPS / SSL</a> (enthält auch ein paar Beispiele mit o-saft)
- Vortrag beim Münchner OWASP-Stammtisch: <a href="/www-pdf-archive/SSL-in-der-Praxis_OWASP-Stammtisch-Muenchen.pdf" title=>Überblick über aktuelle Angriffsmöglichkeiten auf HTTPS / SSL</a> (enthält auch ein paar Beispiele mit o-saft)
(These presentations are in German)
(These presentations are in German)
Project Leader
Project Leader
<a href="User:Achim" title=>Achim</a> Hoffmann
<a href="User:Achim" title=>Achim</a> Hoffmann
Licensing
Licensing
OWASP O-Saft is free to use. It is licensed under the GPL v2 license.
OWASP O-Saft is free to use. It is licensed under the GPL v2 license.
Github
Github
Ohloh
Ohloh
|
- Stable Release (19.01.19): o-saft.tgz
- more see <a href="#Change_Log" title=>#Change Log</a>
Docker
A Docker Container can be found at https://hub.docker.com/r/owasp/o-saft/
News and Events
- [2019] O-Saft is available as package in Kali 2019
- [12. - 16.06.17] O-Saft Track (at OWASP Summit, London)
- 2013 Top Security Tools
- thanks for voting O-Saft as #10 best security tools 2013
Find a OWASP 24/7 podcast about the tool here.
</td>