Skip to content

Commit d06add7

Browse files
ic0nsic0ns
authored
Merge pull request #13 from RUB-NDS/moreAttack
More Attacks & Updated
2 parents 5122787 + a104afc commit d06add7

16 files changed

+363
-31
lines changed

‎README.md

Lines changed: 28 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -4,8 +4,7 @@ TLS-Scanner is a tool created by the Chair for Network and Data Security from th
44
**Please note:** *TLS-Scanner is a research tool intended for TLS developers, pentesters, administrators and researchers. There is no GUI. It is in the first version and may contain some bugs.*
55

66
# Compiling
7-
In order to compile and use TLS-Scanner, you need to have Java installed, as well as [TLS-Attacker](https://github.com/RUB-NDS/TLS-Attacker)
8-
and the [ModifiableVariables](https://github.com/RUB-NDS/ModifiableVariable).
7+
In order to compile and use TLS-Scanner, you need to have Java installed, as well as [TLS-Attacker](https://github.com/RUB-NDS/TLS-Attacker) in Version 2.1
98

109
```bash
1110
$ cd TLS-Scanner
@@ -24,7 +23,7 @@ $ ./mvnw clean install
2423

2524
For hints on installing the required libraries checkout the corresponding GitHub repositories.
2625

27-
**Please note:** *In order to run this tool you need TLS-Attacker version 2.0Beta4*
26+
**Please note:** *In order to run this tool you need TLS-Attacker version 2.1*
2827

2928
# Running
3029
In order to run TLS-Scanner you need to run the jar file in the apps/ folder.
@@ -42,20 +41,31 @@ TLS-Scanner uses the concept of "checks" which are performed after it collected
4241
There are currently multiple checks implemented:
4342

4443

45-
| Check | Meaning |
46-
| ------------------------------- |:------------------------------------------------------------------------:|
47-
| CERTIFICATE_EXPIRED | Checks if the Certificate is expired yet |
48-
| CERTIFICATE_NOT_VALID_YET | Checks if the Certificate is valid yet |
49-
| CERTIFICATE_WEAK_HASH_FUNCTION | Checks if the Server uses a weak Hash algorithm for its Certificate |
50-
| CERTIFICATE_WEAK_SIGN_ALGORITHM | Checks if the Server uses a weak Signature algorithm for its Certificate |
51-
| CERTIFICATE_NOT_SENT_BY_SERVER | Checks if the Server did sent a Certificate at all |
52-
| CIPHERSUITE_ANON | Checks if the Server has Anon Ciphersuites enabled |
53-
| CIPHERSUITE_CBC | Checks if the Server has CBC Ciphersuites enabled for TLS 1.0 |
54-
| CIPHERSUITE_EXPORT | Checks if the Server has Export Ciphersuites enabled |
55-
| CIPHERSUITE_NULL | Checks if the Server has Null Ciphersuites enabled |
56-
| CIPHERSUITE_RC4 | Checks if the Server has RC4 Ciphersuites enabled |
57-
| CIPHERSUITEORDER_ENFORCED | Checks if the Server does not enforce a Ciphersuite ordering |
58-
| PROTOCOLVERSION_SSL2 | Checks if SSL 2 is enabled |
59-
| PROTOCOLVERSION_SSL3 | Checks if SSL 3 is enabled |
44+
| Check | Meaning |
45+
| ------------------------------- |:-----------------------------------------------------------------------------:|
46+
| CERTIFICATE_EXPIRED | Checks if the Certificate is expired yet |
47+
| CERTIFICATE_NOT_VALID_YET | Checks if the Certificate is valid yet |
48+
| CERTIFICATE_WEAK_HASH_FUNCTION | Checks if the Server uses a weak Hash algorithm for its Certificate |
49+
| CERTIFICATE_WEAK_SIGN_ALGORITHM | Checks if the Server uses a weak Signature algorithm for its Certificate |
50+
| CERTIFICATE_NOT_SENT_BY_SERVER | Checks if the Server did sent a Certificate at all |
51+
| CIPHERSUITE_ANON | Checks if the Server has Anon Ciphersuites enabled |
52+
| CIPHERSUITE_CBC | Checks if the Server has CBC Ciphersuites enabled for TLS 1.0 |
53+
| CIPHERSUITE_EXPORT | Checks if the Server has Export Ciphersuites enabled |
54+
| CIPHERSUITE_NULL | Checks if the Server has Null Ciphersuites enabled |
55+
| CIPHERSUITE_RC4 | Checks if the Server has RC4 Ciphersuites enabled |
56+
| CIPHERSUITEORDER_ENFORCED | Checks if the Server does not enforce a Ciphersuite ordering |
57+
| PROTOCOLVERSION_SSL2 | Checks if SSL 2 is enabled |
58+
| PROTOCOLVERSION_SSL3 | Checks if SSL 3 is enabled |
59+
| ATTACK_HEARTBLEED | Checks if the Server is vulnerable to Heartbleed |
60+
| ATTACK_PADDING | Checks if the Server is vulnerable to a Padding_Oracle Attack (BETA) |
61+
| ATTACK_BLEICHENBACHER | Checks if the Server is vulnerable to the Bleichenbacher Attack (BETA) |
62+
| ATTACK_POODLE | Checks if the Server is vulnerable to the Poodle Attack (BETA) |
63+
| ATTACK_TLS_POODLE | Checks if the Server is vulnerable to the TLS variant of Poolde (BETA) |
64+
| ATTACK_CVE20162107 | Checks if the Server is vulnerable to CVE20162107 (BETA) y |
65+
| ATTACK_INVALID_CURVE | Checks if the Server is vulnerable to the Invalid Curve Attack (BETA) |
66+
| ATTACK_INVALID_CURVE_EPHEMERAL | Checks if the Server is vulnerable to an Ephemeral Invalid Curve Attack(BETA) |
67+
68+
69+
6070

6171
**Please note:** *A check with a _result_ of true is considered non optimal*

‎pom.xml

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,13 +3,18 @@
33
<modelVersion>4.0.0</modelVersion>
44
<artifactId>TLS-Scanner</artifactId>
55
<groupId>de.rub.nds.tlsscanner</groupId>
6-
<version>1.0</version>
6+
<version>1.1</version>
77
<packaging>jar</packaging>
88
<dependencies>
99
<dependency>
1010
<groupId>de.rub.nds.tlsattacker</groupId>
1111
<artifactId>TLS-Core</artifactId>
12-
<version>2.0Beta4</version>
12+
<version>2.1</version>
13+
</dependency>
14+
<dependency>
15+
<groupId>de.rub.nds.tlsattacker</groupId>
16+
<artifactId>Attacks</artifactId>
17+
<version>2.1</version>
1318
</dependency>
1419
<dependency>
1520
<groupId>junit</groupId>

‎src/main/java/de/rub/nds/tlsscanner/ScanJobExecutor.java

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,7 @@ public SiteReport execute(ScannerConfig config, ScanJob scanJob) {
4747
resultList.add(probeResult.get());
4848
} catch (InterruptedException | ExecutionException ex) {
4949
LOGGER.warn("Encoutered Exception while retrieving probeResult");
50+
ex.printStackTrace();
5051
LOGGER.warn(ex);
5152
}
5253
}

‎src/main/java/de/rub/nds/tlsscanner/TLSScanner.java

Lines changed: 20 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -11,12 +11,19 @@
1111
import de.rub.nds.tlsattacker.core.config.delegate.ClientDelegate;
1212
import de.rub.nds.tlsattacker.core.config.delegate.GeneralDelegate;
1313
import de.rub.nds.tlsscanner.config.ScannerConfig;
14+
import de.rub.nds.tlsscanner.probe.BleichenbacherProbe;
1415
import de.rub.nds.tlsscanner.report.SiteReport;
1516
import de.rub.nds.tlsscanner.probe.CertificateProbe;
1617
import de.rub.nds.tlsscanner.probe.CiphersuiteOrderProbe;
1718
import de.rub.nds.tlsscanner.probe.CiphersuiteProbe;
19+
import de.rub.nds.tlsscanner.probe.Cve20162107Probe;
20+
import de.rub.nds.tlsscanner.probe.HeartbleedProbe;
21+
import de.rub.nds.tlsscanner.probe.InvalidCurveProbe;
22+
import de.rub.nds.tlsscanner.probe.PaddingOracleProbe;
23+
import de.rub.nds.tlsscanner.probe.PoodleProbe;
1824
import de.rub.nds.tlsscanner.probe.ProtocolVersionProbe;
1925
import de.rub.nds.tlsscanner.probe.TLSProbe;
26+
import de.rub.nds.tlsscanner.probe.TlsPoodleProbe;
2027
import java.util.LinkedList;
2128
import java.util.List;
2229
import org.apache.logging.log4j.Level;
@@ -49,10 +56,14 @@ public TLSScanner(ScannerConfig config) {
4956
this.config = config;
5057
if (config.getGeneralDelegate().getLogLevel() == Level.ALL) {
5158
Configurator.setAllLevels("de.rub.nds.tlsattacker", Level.ALL);
59+
Configurator.setAllLevels("de.rub.nds.modifiablevariable", Level.ALL);
60+
5261
} else if (config.getGeneralDelegate().getLogLevel() == Level.TRACE) {
5362
Configurator.setAllLevels("de.rub.nds.tlsattacker", Level.INFO);
63+
Configurator.setAllLevels("de.rub.nds.modifiablevariable", Level.INFO);
5464
} else {
5565
Configurator.setAllLevels("de.rub.nds.tlsattacker", Level.OFF);
66+
Configurator.setAllLevels("de.rub.nds.modifiablevariable", Level.OFF);
5667
}
5768
}
5869

@@ -62,9 +73,15 @@ public SiteReport scan() {
6273
testList.add(new ProtocolVersionProbe(config));
6374
testList.add(new CiphersuiteProbe(config));
6475
testList.add(new CiphersuiteOrderProbe(config));
65-
// testList.add(new HeartbleedProbe(websiteHost));
66-
// testList.add(new NamedCurvesProbe(websiteHost));
67-
// testList.add(new PaddingOracleProbe(websiteHost));
76+
testList.add(new HeartbleedProbe(config));
77+
//testList.add(new NamedCurvesProbe(websiteHost));
78+
testList.add(new PaddingOracleProbe(config));
79+
testList.add(new BleichenbacherProbe(config));
80+
testList.add(new PoodleProbe(config));
81+
testList.add(new TlsPoodleProbe(config));
82+
testList.add(new Cve20162107Probe(config));
83+
testList.add(new InvalidCurveProbe(config));
84+
6885
// testList.add(new SignatureAndHashAlgorithmProbe(websiteHost));
6986
ScanJob job = new ScanJob(testList);
7087
return executor.execute(config, job);

‎src/main/java/de/rub/nds/tlsscanner/probe/BleichenbacherProbe.java

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
/*
2+
* To change this license header, choose License Headers in Project Properties.
3+
* To change this template file, choose Tools | Templates
4+
* and open the template in the editor.
5+
*/
6+
package de.rub.nds.tlsscanner.probe;
7+
8+
import de.rub.nds.tlsattacker.attacks.config.BleichenbacherCommandConfig;
9+
import de.rub.nds.tlsattacker.attacks.config.HeartbleedCommandConfig;
10+
import de.rub.nds.tlsattacker.attacks.impl.BleichenbacherAttacker;
11+
import de.rub.nds.tlsattacker.attacks.impl.HeartbleedAttacker;
12+
import de.rub.nds.tlsattacker.core.config.delegate.ClientDelegate;
13+
import de.rub.nds.tlsscanner.config.ScannerConfig;
14+
import de.rub.nds.tlsscanner.report.ProbeResult;
15+
import de.rub.nds.tlsscanner.report.ResultValue;
16+
import de.rub.nds.tlsscanner.report.check.CheckType;
17+
import de.rub.nds.tlsscanner.report.check.TLSCheck;
18+
import java.util.LinkedList;
19+
import java.util.List;
20+
21+
/**
22+
*
23+
* @author Robert Merget <[email protected]>
24+
*/
25+
public class BleichenbacherProbe extends TLSProbe {
26+
27+
public BleichenbacherProbe(ScannerConfig config) {
28+
super(ProbeType.BLEICHENBACHER, config);
29+
}
30+
31+
@Override
32+
public ProbeResult call() {
33+
LOGGER.debug("Starting BleichenbacherProbe");
34+
BleichenbacherCommandConfig bleichenbacherConfig = new BleichenbacherCommandConfig(getScannerConfig().getGeneralDelegate());
35+
ClientDelegate delegate = (ClientDelegate) bleichenbacherConfig.getDelegate(ClientDelegate.class);
36+
delegate.setHost(getScannerConfig().getClientDelegate().getHost());
37+
BleichenbacherAttacker attacker = new BleichenbacherAttacker(bleichenbacherConfig);
38+
Boolean vulnerable = attacker.isVulnerable();
39+
TLSCheck check = new TLSCheck(vulnerable, CheckType.ATTACK_BLEICHENBACHER, 10);
40+
List<TLSCheck> checkList = new LinkedList<>();
41+
checkList.add(check);
42+
return new ProbeResult(getType(), new LinkedList<ResultValue>(), checkList);
43+
44+
}
45+
46+
}

‎src/main/java/de/rub/nds/tlsscanner/probe/CertificateProbe.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@ public ProbeResult call() {
3838
tlsConfig.setQuickReceive(true);
3939
tlsConfig.setEarlyStop(true);
4040
tlsConfig.setWorkflowTraceType(WorkflowTraceType.HELLO);
41-
tlsConfig.setSniHostname(tlsConfig.getConnectionEnd().getHostname());
41+
tlsConfig.setSniHostname(tlsConfig.getDefaultClientConnection().getHostname());
4242
tlsConfig.setAddServerNameIndicationExtension(true);
4343
tlsConfig.setStopActionsAfterFatal(true);
4444
Certificate serverCert = CertificateFetcher.fetchServerCertificate(tlsConfig);

‎src/main/java/de/rub/nds/tlsscanner/probe/CiphersuiteOrderProbe.java

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,12 +14,10 @@
1414
import de.rub.nds.tlsattacker.core.constants.ProtocolVersion;
1515
import de.rub.nds.tlsattacker.core.exceptions.WorkflowExecutionException;
1616
import de.rub.nds.tlsattacker.core.state.State;
17-
import de.rub.nds.tlsattacker.core.state.TlsContext;
1817
import de.rub.nds.tlsattacker.core.workflow.WorkflowExecutor;
1918
import de.rub.nds.tlsattacker.core.workflow.WorkflowExecutorFactory;
2019
import de.rub.nds.tlsattacker.core.workflow.action.executor.WorkflowExecutorType;
2120
import de.rub.nds.tlsattacker.core.workflow.factory.WorkflowTraceType;
22-
import de.rub.nds.tlsattacker.transport.ClientConnectionEnd;
2321
import de.rub.nds.tlsscanner.config.ScannerConfig;
2422
import de.rub.nds.tlsscanner.report.ProbeResult;
2523
import de.rub.nds.tlsscanner.report.ResultValue;

‎src/main/java/de/rub/nds/tlsscanner/probe/Cve20162107Probe.java

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
/**
2+
* TLS-Scanner - A TLS Configuration Analysistool based on TLS-Attacker
3+
*
4+
* Copyright 2014-2017 Ruhr University Bochum / Hackmanit GmbH
5+
*
6+
* Licensed under Apache License 2.0
7+
* http://www.apache.org/licenses/LICENSE-2.0
8+
*/
9+
package de.rub.nds.tlsscanner.probe;
10+
11+
import de.rub.nds.tlsattacker.attacks.config.Cve20162107CommandConfig;
12+
import de.rub.nds.tlsattacker.attacks.impl.Cve20162107Attacker;
13+
import de.rub.nds.tlsattacker.core.config.delegate.ClientDelegate;
14+
import de.rub.nds.tlsscanner.config.ScannerConfig;
15+
import de.rub.nds.tlsscanner.report.ProbeResult;
16+
import de.rub.nds.tlsscanner.report.ResultValue;
17+
import de.rub.nds.tlsscanner.report.check.CheckType;
18+
import de.rub.nds.tlsscanner.report.check.TLSCheck;
19+
import java.util.LinkedList;
20+
import java.util.List;
21+
22+
/**
23+
*
24+
* @author Robert Merget - [email protected]
25+
*/
26+
public class Cve20162107Probe extends TLSProbe {
27+
28+
public Cve20162107Probe(ScannerConfig config) {
29+
super(ProbeType.CVE20162107, config);
30+
}
31+
32+
@Override
33+
public ProbeResult call() {
34+
LOGGER.debug("Starting Cve20162107 Probe");
35+
Cve20162107CommandConfig poodleCommandConfig = new Cve20162107CommandConfig(getScannerConfig().getGeneralDelegate());
36+
ClientDelegate delegate = (ClientDelegate) poodleCommandConfig.getDelegate(ClientDelegate.class);
37+
delegate.setHost(getScannerConfig().getClientDelegate().getHost());
38+
Cve20162107Attacker attacker = new Cve20162107Attacker(poodleCommandConfig);
39+
Boolean vulnerable = attacker.isVulnerable();
40+
TLSCheck check = new TLSCheck(vulnerable, CheckType.ATTACK_CVE20162107, 10);
41+
List<TLSCheck> checkList = new LinkedList<>();
42+
checkList.add(check);
43+
return new ProbeResult(getType(), new LinkedList<ResultValue>(), checkList);
44+
}
45+
46+
}

‎src/main/java/de/rub/nds/tlsscanner/probe/HeartbleedProbe.java

Lines changed: 23 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,8 +8,18 @@
88
*/
99
package de.rub.nds.tlsscanner.probe;
1010

11+
import de.rub.nds.tlsattacker.attacks.config.HeartbleedCommandConfig;
12+
import de.rub.nds.tlsattacker.attacks.config.PaddingOracleCommandConfig;
13+
import de.rub.nds.tlsattacker.attacks.impl.HeartbleedAttacker;
14+
import de.rub.nds.tlsattacker.attacks.impl.PaddingOracleAttacker;
15+
import de.rub.nds.tlsattacker.core.config.delegate.ClientDelegate;
1116
import de.rub.nds.tlsscanner.config.ScannerConfig;
1217
import de.rub.nds.tlsscanner.report.ProbeResult;
18+
import de.rub.nds.tlsscanner.report.ResultValue;
19+
import de.rub.nds.tlsscanner.report.check.CheckType;
20+
import de.rub.nds.tlsscanner.report.check.TLSCheck;
21+
import java.util.LinkedList;
22+
import java.util.List;
1323

1424
/**
1525
*
@@ -23,7 +33,19 @@ public HeartbleedProbe(ScannerConfig config) {
2333

2434
@Override
2535
public ProbeResult call() {
26-
throw new UnsupportedOperationException("Not supported yet.");
36+
LOGGER.debug("Starting HeartbleedProbe");
37+
HeartbleedCommandConfig heartbleedConfig = new HeartbleedCommandConfig(getScannerConfig().getGeneralDelegate());
38+
ClientDelegate delegate = (ClientDelegate) heartbleedConfig.getDelegate(ClientDelegate.class);
39+
delegate.setHost(getScannerConfig().getClientDelegate().getHost());
40+
HeartbleedAttacker attacker = new HeartbleedAttacker(heartbleedConfig);
41+
Boolean vulnerable = attacker.isVulnerable();
42+
if (vulnerable == null) {
43+
vulnerable = false;
44+
}
45+
TLSCheck check = new TLSCheck(vulnerable, CheckType.ATTACK_HEARTBLEED, 10);
46+
List<TLSCheck> checkList = new LinkedList<>();
47+
checkList.add(check);
48+
return new ProbeResult(getType(), new LinkedList<ResultValue>(), checkList);
2749
}
2850

2951
}

‎src/main/java/de/rub/nds/tlsscanner/probe/InvalidCurveProbe.java

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
/**
2+
* TLS-Scanner - A TLS Configuration Analysistool based on TLS-Attacker
3+
*
4+
* Copyright 2014-2017 Ruhr University Bochum / Hackmanit GmbH
5+
*
6+
* Licensed under Apache License 2.0
7+
* http://www.apache.org/licenses/LICENSE-2.0
8+
*/
9+
package de.rub.nds.tlsscanner.probe;
10+
11+
import de.rub.nds.tlsattacker.attacks.config.InvalidCurveAttackConfig;
12+
import de.rub.nds.tlsattacker.attacks.impl.InvalidCurveAttacker;
13+
import de.rub.nds.tlsattacker.core.config.delegate.ClientDelegate;
14+
import de.rub.nds.tlsscanner.config.ScannerConfig;
15+
import de.rub.nds.tlsscanner.report.ProbeResult;
16+
import de.rub.nds.tlsscanner.report.ResultValue;
17+
import de.rub.nds.tlsscanner.report.check.CheckType;
18+
import de.rub.nds.tlsscanner.report.check.TLSCheck;
19+
import java.util.LinkedList;
20+
import java.util.List;
21+
22+
/**
23+
*
24+
* @author Robert Merget - [email protected]
25+
*/
26+
public class InvalidCurveProbe extends TLSProbe {
27+
28+
public InvalidCurveProbe(ScannerConfig config) {
29+
super(ProbeType.INVALID_CURVE, config);
30+
}
31+
32+
@Override
33+
public ProbeResult call() {
34+
LOGGER.debug("Starting InvalidCurveProbe");
35+
InvalidCurveAttackConfig invalidCurveAttackConfig = new InvalidCurveAttackConfig(getScannerConfig().getGeneralDelegate());
36+
ClientDelegate delegate = (ClientDelegate) invalidCurveAttackConfig.getDelegate(ClientDelegate.class);
37+
delegate.setHost(getScannerConfig().getClientDelegate().getHost());
38+
InvalidCurveAttacker attacker = new InvalidCurveAttacker(invalidCurveAttackConfig);
39+
Boolean vulnerable = attacker.isVulnerable();
40+
if (vulnerable == null) {
41+
vulnerable = false; //TODO
42+
}
43+
TLSCheck check = new TLSCheck(vulnerable, CheckType.ATTACK_INVALID_CURVE, 10);
44+
List<TLSCheck> checkList = new LinkedList<>();
45+
checkList.add(check);
46+
invalidCurveAttackConfig = new InvalidCurveAttackConfig(getScannerConfig().getGeneralDelegate());
47+
invalidCurveAttackConfig.setEphemeral(true);
48+
delegate = (ClientDelegate) invalidCurveAttackConfig.getDelegate(ClientDelegate.class);
49+
delegate.setHost(getScannerConfig().getClientDelegate().getHost());
50+
attacker = new InvalidCurveAttacker(invalidCurveAttackConfig);
51+
vulnerable = attacker.isVulnerable();
52+
if (vulnerable == null) {
53+
vulnerable = false; //TODO
54+
}
55+
check = new TLSCheck(vulnerable, CheckType.ATTACK_INVALID_CURVE_EPHEMERAL, 10);
56+
checkList.add(check);
57+
58+
return new ProbeResult(getType(), new LinkedList<ResultValue>(), checkList);
59+
}
60+
}

0 commit comments

Comments
 (0)