This tool can be used to determine if an application that uses TLS/SSL for its data transfers does this in a secure way.
sudo apt install qsslcaudit (1.11 MB)
Dependências: libc6, libcrypto++8t64, libgcc-s1, libgnutls30t64, libqt5core5t64, libqt5network5t64, libstdc++6, libunsafessl1.0.2
Escolha um comando ao lado para ver a descrição e a ajuda completa.
qsslcaudit
root@kali:~# qsslcaudit -h
Usage: qsslcaudit [options]
A tool to test SSL clients behavior
SSL client tests:
1: (certs) custom certificate trust
certificate trust test with user-supplied certificate
2: (certs) self-signed certificate for target domain trust
certificate trust test with self-signed certificate for user-supplied common name
3: (certs) self-signed certificate for invalid domain trust
certificate trust test with self-signed certificate for www.example.com
4: (certs) custom certificate for target domain trust
certificate trust test with user-supplied common name signed by user-supplied certificate
5: (certs) custom certificate for invalid domain trust
certificate trust test with www.example.com common name signed by user-supplied certificate
6: (certs) certificate for target domain signed by custom CA trust
certificate trust test with user-supplied common name signed by user-supplied CA certificate
7: (certs) certificate for invalid domain signed by custom CA trust
certificate trust test with www.example.com common name signed by user-supplied CA certificate
8: (protos) SSLv2 protocol support
test for SSLv2 protocol support
9: (protos) SSLv3 protocol support
test for SSLv3 protocol support
10: (ciphers) SSLv3 protocol and EXPORT grade ciphers support
test for SSLv3 protocol and EXPORT grade ciphers support
11: (ciphers) SSLv3 protocol and LOW grade ciphers support
test for SSLv3 protocol and LOW grade ciphers support
12: (ciphers) SSLv3 protocol and MEDIUM grade ciphers support
test for SSLv3 protocol and MEDIUM grade ciphers support
13: (protos) TLS 1.0 protocol support
test for TLS 1.0 protocol support
14: (ciphers) TLS 1.0 protocol and EXPORT grade ciphers support
test for TLS 1.0 protocol and EXPORT grade ciphers support
15: (ciphers) TLS 1.0 protocol and LOW grade ciphers support
test for TLS 1.0 protocol and LOW grade ciphers support
16: (ciphers) TLS 1.0 protocol and MEDIUM grade ciphers support
test for TLS 1.0 protocol and MEDIUM grade ciphers support
17: (ciphers) TLS 1.1 protocol and EXPORT grade ciphers support
test for TLS 1.1 protocol and EXPORT grade ciphers support
18: (ciphers) TLS 1.1 protocol and LOW grade ciphers support
test for TLS 1.1 protocol and LOW grade ciphers support
19: (ciphers) TLS 1.1 protocol and MEDIUM grade ciphers support
test for TLS 1.1 protocol and MEDIUM grade ciphers support
20: (ciphers) TLS 1.2 protocol and EXPORT grade ciphers support
test for TLS 1.2 protocol and EXPORT grade ciphers support
21: (ciphers) TLS 1.2 protocol and LOW grade ciphers support
test for TLS 1.2 protocol and LOW grade ciphers support
22: (ciphers) TLS 1.2 protocol and MEDIUM grade ciphers support
test for TLS 1.2 protocol and MEDIUM grade ciphers support
23: (ciphers) DTLS 1.0 protocol and EXPORT grade ciphers support
test for DTLS 1.0 protocol and EXPORT grade ciphers support
24: (ciphers) DTLS 1.0 protocol and LOW grade ciphers support
test for DTLS 1.0 protocol and LOW grade ciphers support
25: (ciphers) DTLS 1.0 protocol and MEDIUM grade ciphers support
test for DTLS 1.0 protocol and MEDIUM grade ciphers support
26: (ciphers) DTLS 1.2 protocol and EXPORT grade ciphers support
test for DTLS 1.2 protocol and EXPORT grade ciphers support
27: (ciphers) DTLS 1.2 protocol and LOW grade ciphers support
test for DTLS 1.2 protocol and LOW grade ciphers support
28: (ciphers) DTLS 1.2 protocol and MEDIUM grade ciphers support
test for DTLS 1.2 protocol and MEDIUM grade ciphers support
29: (certs) CVE-2020-0601 ECC cert trust
test for trusting certificate signed by private key with custom curve
Options:
-h, --help Displays help on commandline options.
--help-all Displays help including Qt specific options.
-v, --version Displays version information.
-l, --listen-address <0.0.0.0> listen on <address>
-p, --listen-port <8443> bind to <port>
--user-cn <example.com> common name (CN) to suggest to client
--server <https://example.com> grab certificate information from <server>
--user-cert <~/host.cert> path to file containing custom certificate
(or chain of certificates)
--user-key <~/host.key> path to file containing custom private key
--user-ca-cert <~/ca.cert> path to file containing custom certificate
usable as CA
--user-ca-key <~/ca.key> path to file containing custom private key
for CA certificate
--selected-tests <1,3,5> comma-separated list of tests (id) to execute
--forward <127.0.0.1:6666> forward connection to upstream proxy
--show-ciphers show ciphers provided by loaded openssl
library
--starttls <ftp|smtp|xmpp> exchange specific STARTTLS messages before
starting secure connection
--loop-tests infinitely repeat selected tests (use Ctrl-C
to kill the tool)
-w, --wait-data-timeout <5000> wait for incoming data <ms> milliseconds
before emitting error
--output-xml <qsslcaudit.xml> save results in XML
--pid-file </tmp/qs.pid> create a pidfile once initialized
--dtls use DTLS protocol over UDP
--double-first-test execute the first test two times and ignore
its client fingerprint