-

Appendix: Scan CommandsΒΆ

+

Appendix: Scan CommandsΒΆ

Every type of TLS check that SSLyze can run against a server (supported cipher suites, session renegotiation, etc.) is represented by a ScanCommand, which, when run against a server, will return a specific result.

This page lists all the ScanCommand and their corresponding results available in the current release of SSLyze.

@@ -41,20 +41,20 @@

Appendix: Scan Commands

Contents

@@ -153,7 +153,7 @@

Appendix: Scan Commands

Certificate InformationΒΆ

+

Certificate InformationΒΆ

ScanCommand.CERTIFICATE_INFO: Retrieve and analyze a server’s certificate(s) to verify its validity.

Optional argumentsΒΆ

@@ -257,7 +257,7 @@

Result classPathValidationResult.

Type
-

List[sslyze.plugins.certificate_info._cert_chain_analyzer.PathValidationResult]

+

List[sslyze.plugins.certificate_info.trust_stores.trust_store.PathValidationResult]

@@ -397,7 +397,7 @@

Result classOptional[int]) –

  • received_chain_contains_anchor_certificate (Optional[bool]) –

  • received_chain_has_valid_order (Optional[bool]) –

  • -
  • path_validation_results (List[PathValidationResult]) –

  • +
  • path_validation_results (List[PathValidationResult]) –

  • verified_chain_has_sha1_signature (Optional[bool]) –

  • verified_chain_has_legacy_symantec_anchor (Optional[bool]) –

  • ocsp_response (Optional[OCSPResponse]) –

  • @@ -412,9 +412,14 @@

    Result classclass sslyze.PathValidationResult(trust_store, verified_certificate_chain, openssl_error_string)ΒΆ

    The result of trying to validate a server’s certificate chain using a specific trust store.

    -
    -trust_storesΒΆ
    +
    +trust_storeΒΆ

    The trust store used for validation.

    +
    +
    Type
    +

    sslyze.plugins.certificate_info.trust_stores.trust_store.TrustStore

    +
    +
    @@ -469,33 +474,18 @@

    Result class pathΒΆ

    The path on the local system to the PEM-formatted file containing the root certificates.

    -
    -
    Type
    -

    pathlib.Path

    -
    -

    nameΒΆ

    The human-readable name of the trust store (such as β€œMozilla”).

    -
    -
    Type
    -

    str

    -
    -
    versionΒΆ

    The human-readable version or date of the trust store (such as β€œ09/2016”).

    -
    -
    Type
    -

    str

    -
    -
    @@ -508,26 +498,6 @@

    Result class -
    -path: pathlib.PathΒΆ
    -

    - -
    -
    -name: strΒΆ
    -
    - -
    -
    -version: strΒΆ
    -
    - -
    -
    -ev_oids: Optional[List[ObjectIdentifier]] = NoneΒΆ
    -
    -
    is_certificate_extended_validation(certificate)ΒΆ
    @@ -542,20 +512,33 @@

    Result class +
    +verify_certificate_chain(certificate_chain_as_pem)ΒΆ
    +
    +
    Parameters
    +

    certificate_chain_as_pem (List[str]) –

    +
    +
    Return type
    +

    PathValidationResult

    +
    +
    +

    +

    -

    Cipher SuitesΒΆ

    +

    Cipher SuitesΒΆ

    ScanCommand.SSL_2_0_CIPHER_SUITES: Test a server for SSL 2.0 support. ScanCommand.SSL_3_0_CIPHER_SUITES: Test a server for SSL 3.0 support. ScanCommand.TLS_1_0_CIPHER_SUITES: Test a server for TLS 1.0 support. ScanCommand.TLS_1_1_CIPHER_SUITES: Test a server for TLS 1.1 support. ScanCommand.TLS_1_2_CIPHER_SUITES: Test a server for TLS 1.2 support. ScanCommand.TLS_1_3_CIPHER_SUITES: Test a server for TLS 1.3 support.

    -
    -

    Result classΒΆ

    +
    +

    Result classΒΆ

    class sslyze.CipherSuitesScanResult(tls_version_used, accepted_cipher_suites, rejected_cipher_suites)ΒΆ
    @@ -693,10 +676,10 @@

    Result class -

    Supported Elliptic CurvesΒΆ

    +

    Supported Elliptic CurvesΒΆ

    ScanCommand.ELLIPTIC_CURVES: Test a server for supported elliptic curves.

    -
    -

    Result classΒΆ

    +
    +

    Result classΒΆ

    class sslyze.SupportedEllipticCurvesScanResult(supports_ecdh_key_exchange, supported_curves, rejected_curves)ΒΆ
    @@ -786,10 +769,10 @@

    Result class -

    ROBOTΒΆ

    +

    ROBOTΒΆ

    ScanCommand.ROBOT: Test a server for the ROBOT vulnerability.

    -
    -

    Result classΒΆ

    +
    +

    Result classΒΆ

    class sslyze.RobotScanResult(robot_result)ΒΆ
    @@ -842,28 +825,28 @@

    Result class -
    -VULNERABLE_WEAK_ORACLE = 'VULNERABLE_WEAK_ORACLE'ΒΆ
    +
    +VULNERABLE_WEAK_ORACLE = 'VULNERABLE_WEAK_ORACLE'ΒΆ

    -
    -VULNERABLE_STRONG_ORACLE = 'VULNERABLE_STRONG_ORACLE'ΒΆ
    +
    +VULNERABLE_STRONG_ORACLE = 'VULNERABLE_STRONG_ORACLE'ΒΆ
    -
    -NOT_VULNERABLE_NO_ORACLE = 'NOT_VULNERABLE_NO_ORACLE'ΒΆ
    +
    +NOT_VULNERABLE_NO_ORACLE = 'NOT_VULNERABLE_NO_ORACLE'ΒΆ
    -
    -NOT_VULNERABLE_RSA_NOT_SUPPORTED = 'NOT_VULNERABLE_RSA_NOT_SUPPORTED'ΒΆ
    +
    +NOT_VULNERABLE_RSA_NOT_SUPPORTED = 'NOT_VULNERABLE_RSA_NOT_SUPPORTED'ΒΆ
    -
    -UNKNOWN_INCONSISTENT_RESULTS = 'UNKNOWN_INCONSISTENT_RESULTS'ΒΆ
    +
    +UNKNOWN_INCONSISTENT_RESULTS = 'UNKNOWN_INCONSISTENT_RESULTS'ΒΆ
    @@ -871,10 +854,10 @@

    Result class -

    Session Resumption SupportΒΆ

    +

    Session Resumption SupportΒΆ

    ScanCommand.SESSION_RESUMPTION: Test a server for TLS 1.2 session resumption support using session IDs and TLS tickets.

    -
    -

    Result classΒΆ

    +
    +

    Result classΒΆ

    class sslyze.TlsResumptionSupportEnum(value)ΒΆ
    @@ -1017,10 +1000,10 @@

    Result class -

    CRIMEΒΆ

    +

    CRIMEΒΆ

    ScanCommand.TLS_COMPRESSION: Test a server for TLS compression support, which can be leveraged to perform a CRIME attack.

    -
    -

    Result classΒΆ

    +
    +

    Result classΒΆ

    class sslyze.CompressionScanResult(supports_compression)ΒΆ
    @@ -1046,10 +1029,10 @@

    Result class -

    TLS 1.3 Early DataΒΆ

    +

    TLS 1.3 Early DataΒΆ

    ScanCommand.TLS_1_3_EARLY_DATA: Test the server(s) for TLS 1.3 early data support.

    -
    -

    Result classΒΆ

    +
    +

    Result classΒΆ

    class sslyze.EarlyDataScanResult(supports_early_data)ΒΆ
    @@ -1075,10 +1058,10 @@

    Result class -

    Downgrade PreventionΒΆ

    +

    Downgrade PreventionΒΆ

    ScanCommand.TLS_FALLBACK_SCSV: Test a server for the TLS_FALLBACK_SCSV mechanism to prevent downgrade attacks.

    -
    -

    Result classΒΆ

    +
    +

    Result classΒΆ

    class sslyze.FallbackScsvScanResult(supports_fallback_scsv)ΒΆ
    @@ -1104,10 +1087,10 @@

    Result class -

    HeartbleedΒΆ

    +

    HeartbleedΒΆ

    ScanCommand.HEARTBLEED: Test a server for the OpenSSL Heartbleed vulnerability.

    -
    -

    Result classΒΆ

    +
    +

    Result classΒΆ

    class sslyze.HeartbleedScanResult(is_vulnerable_to_heartbleed)ΒΆ
    @@ -1133,13 +1116,13 @@

    Result class -

    HTTP Security HeadersΒΆ

    +

    HTTP Security HeadersΒΆ

    ScanCommand.HTTP_HEADERS: Test a server for the presence of security-related HTTP headers.

    -
    -

    Result classΒΆ

    +
    +

    Result classΒΆ

    -class sslyze.HttpHeadersScanResult(http_request_sent, http_error_trace, http_path_redirected_to, strict_transport_security_header, expect_ct_header)ΒΆ
    +class sslyze.HttpHeadersScanResult(http_request_sent, http_error_trace, http_path_redirected_to, strict_transport_security_header, expect_ct_header=None)ΒΆ

    The result of testing a server for the presence of security-related HTTP headers.

    Each HTTP header described below will be None if the server did not return a valid HTTP response, or if the server returned an HTTP response without the HTTP header.

    @@ -1191,10 +1174,11 @@

    Result class
    expect_ct_headerΒΆ
    -

    The Expect-CT header returned by the server.

    +

    DEPRECATED - will always be None. This is because the Expect-CT header has officially +been deprecated.

    Type
    -

    Optional[sslyze.plugins.http_headers_plugin.ExpectCtHeader]

    +

    None

    @@ -1206,7 +1190,7 @@

    Result classOptional[TracebackException]) –

  • http_path_redirected_to (Optional[str]) –

  • strict_transport_security_header (Optional[StrictTransportSecurityHeader]) –

  • -
  • expect_ct_header (Optional[ExpectCtHeader]) –

  • +
  • expect_ct_header (None) –

  • @@ -1301,10 +1285,10 @@

    Result class -

    OpenSSL CCS InjectionΒΆ

    +

    OpenSSL CCS InjectionΒΆ

    ScanCommand.OPENSSL_CCS_INJECTION: Test a server for the OpenSSL CCS Injection vulnerability (CVE-2014-0224).

    -
    -

    Result classΒΆ

    +
    +

    Result classΒΆ

    class sslyze.OpenSslCcsInjectionScanResult(is_vulnerable_to_ccs_injection)ΒΆ
    @@ -1330,10 +1314,10 @@

    Result class -

    Insecure RenegotiationΒΆ

    +

    Insecure RenegotiationΒΆ

    ScanCommand.SESSION_RENEGOTIATION: Test a server for for insecure TLS renegotiation and client-initiated renegotiation.

    -
    -

    Result classΒΆ

    +
    +

    Result classΒΆ

    class sslyze.SessionRenegotiationScanResult(supports_secure_renegotiation, is_vulnerable_to_client_renegotiation_dos)ΒΆ
    diff --git a/docs/documentation/genindex.html b/docs/documentation/genindex.html index dd26bc72..203cd3b3 100644 --- a/docs/documentation/genindex.html +++ b/docs/documentation/genindex.html @@ -5,7 +5,7 @@ - Index — SSLyze 5.0.6 documentation + Index — SSLyze 5.1.0 documentation @@ -136,16 +136,14 @@

    E

  • EllipticCurve (class in sslyze)
  • enforce (sslyze.ExpectCtHeader attribute) -
  • -
  • EphemeralKeyInfo (class in sslyze)