ToolWar | Information Security (InfoSec) Tools: SSL/TLS

<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhrZyKNhyphenhyphenNN1-cYypGXqoLUErO5y7F-od5ou1fO4m9ViAXljsDDnINyDGBvdk1SGRfYbZnVDNBvg_-b7pOI4JTOSKEGfSxfYai6pY0-f5hP_4TTJuvyLdgBbo3Ef4pUS5ylCqFhZZx2SvwW/s1600/NoGotofail+toolwar.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="272" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhrZyKNhyphenhyphenNN1-cYypGXqoLUErO5y7F-od5ou1fO4m9ViAXljsDDnINyDGBvdk1SGRfYbZnVDNBvg_-b7pOI4JTOSKEGfSxfYai6pY0-f5hP_4TTJuvyLdgBbo3Ef4pUS5ylCqFhZZx2SvwW/s1600/NoGotofail+toolwar.jpg" width="640" /></a></div>
<div style="text-align: justify;">
 </div>
<div style="text-align: justify;">
Nogotofail is a network security testing tool designed to help developers and
<a href="http://www.toolwar.com/search/label/Security" target="_blank">security</a> researchers spot and fix weak TLS/SSL connections and sensitive
cleartext traffic on devices and applications in a flexible, scalable, powerful way.
It includes testing for common SSL certificate verification issues, HTTPS and TLS/SSL
library bugs, SSL and STARTTLS stripping issues, cleartext issues, and more.</div>
<div style="text-align: justify;">
Google is committed to increasing the use of TLS/SSL in all applications and services. But “HTTPS everywhere” is not enough; it also needs to be used correctly. Most platforms and devices have secure defaults, but some applications and libraries override the defaults for the worse, and in some instances we’ve seen platforms make mistakes as well. As applications get more complex, connect to more services, and use more third party libraries, it becomes easier to introduce these types of mistakes. The Android Security Team has built a tool, called nogotofail, that provides an easy way to confirm that the devices or applications you are using are safe against known TLS/SSL vulnerabilities and misconfigurations. Nogotofail works for <a href="http://www.toolwar.com/search/label/Android" target="_blank">Android</a>, iOS, <a href="http://www.toolwar.com/search/label/Linux" target="_blank">Linux</a>, <a href="http://www.toolwar.com/search/label/Windows" target="_blank">Windows</a>, Chrome OS, OSX, in fact any device you use to connect to the Internet. There’s an easy-to-use client to configure the settings and get notifications on Android and Linux, as well as the attack engine itself which can be deployed as a router, VPN server, or proxy. We’ve been using this tool ourselves for some time and have worked with many developers to improve the security of their apps. But we want the use of TLS/SSL to advance as quickly as possible. Today, we’re releasing it as an open source project, so anyone can test their applications, contribute new features, provide support for more platforms, and help improve the security of the Internet.</div>
<h3 style="text-align: justify;">
Download ::</h3>
<div style="text-align: justify;">
Python: <a href="https://github.com/google/nogotofail/archive/dev.zip" target="_blank">nogotofail</a> (Github)</div>
<div style="text-align: justify;">
Official Website: https://github.com/google/nogotofail</div>

NoGoToFail :: Network Traffic Security Testing Tool

Nogotofail is a network security testing tool designed to help developers and security researchers spot and fix weak TLS/SSL connect...

<div class="separator" style="clear: both; text-align: center;">
<img alt="sslsplit" border="0" height="220" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhiKnDa1SmFAz2I_uUyfY8OE-KawIYa9Rk7T3wbyfUM42-zCwgo1Hs18FThDil200FpKE2OdkcCO9Uvk0_lHGNieQuDLgJxQVuvj7VN0Yhxbtky5w-AyzRHrrqWZB4Qrf8q5dafKyblfRnO/s1600/SSLsplit.jpg" title="sslsplit" width="400" /></div>
<div style="text-align: justify;">
SSLsplit is a tool for <a href="http://www.toolwar.com/search/label/MITM" target="_blank">man-in-the-middle attacks</a> against SSL/TLS encrypted
<a href="http://www.toolwar.com/search/label/Network" target="_blank">network</a> connections. Connections are transparently intercepted through a
network address translation engine and redirected to SSLsplit. SSLsplit
terminates SSL/TLS and initiates a new SSL/TLS connection to the original
destination address, while logging all data transmitted. SSLsplit is intended
to be useful for network <a href="http://www.toolwar.com/search/label/Forensics" target="_blank">forensics</a> and <a href="http://www.toolwar.com/search/label/Penetration" target="_blank">penetration testing</a>.</div>
 
<div style="text-align: justify;">
SSLsplit supports plain TCP, plain SSL, HTTP and HTTPS connections over both
IPv4 and IPv6. For SSL and HTTPS connections, SSLsplit generates and signs
forged X509v3 certificates on-the-fly, based on the original server certificate
subject DN and subjectAltName extension. SSLsplit fully supports Server Name
Indication (SNI) and is able to work with RSA, DSA and ECDSA keys and DHE and
ECDHE cipher suites. SSLsplit can also use existing certificates of which the
private key is available, instead of generating forged ones. SSLsplit supports
NULL-prefix CN certificates and can deny OCSP requests in a generic way.
SSLsplit removes HPKP response headers in order to prevent public key pinning.</div>
<h3 style="text-align: justify;">
Tutorials ::</h3>
<div style="text-align: justify;">
Installation ::</div>
<div style="text-align: justify;">
SSLsplit is or will be available as a package or port on the following systems:</div>
<ul style="text-align: justify;">
<li>OpenBSD: security/sslsplit</li>
<li>Arch Linux AUR: sslsplit</li>
<li>Fedora: sslsplit</li>
<li>Kali: sslsplit</li>
<li>Backtrack: sslsplit</li>
</ul>
<div style="text-align: justify;">
To install from source:</div>
<div style="text-align: justify;">
<pre><code class=" ruby">make
make test # optional unit tests
make install # optional install
</code></pre>
</div>
<div style="text-align: justify;">
 </div>
<div style="text-align: justify;">
Usage ::</div>
<div style="text-align: justify;">
<pre><code class=" sql">% sslsplit -h
Usage: sslsplit [options...] [proxyspecs...]
 -c pemfile use CA cert (and key) from pemfile to sign forged certs
 -k pemfile use CA key (and cert) from pemfile to sign forged certs
 -C pemfile use CA chain from pemfile (intermediate and root CA certs)
 -K pemfile use key from pemfile for leaf certs (default: generate)
 -t certdir use cert+chain+key PEM files from certdir to target all sites
 matching the common names (non-matching: generate if CA)
 -O deny all OCSP requests on all proxyspecs
 -P passthrough SSL connections if they cannot be split because of
 client cert auth or no matching cert and no CA (default: drop)
 -g pemfile use DH group params from pemfile (default: keyfiles or auto)
 -G curve use ECDH named curve (default: secp160r2 for non-RSA leafkey)
 -Z disable SSL/TLS compression on all connections
 -s ciphers use the given OpenSSL cipher suite spec (default: ALL:-aNULL)
 -e engine specify default NAT engine to use (default: ipfw)
 -E list available NAT engines and exit
 -u user drop privileges to user (default if run as root: nobody)
 -j jaildir chroot() to jaildir (default if run as root: /var/empty)
 -p pidfile write pid to pidfile (default: no pid file)
 -l logfile connect log: log one line summary per connection to logfile
 -L logfile content log: full data to file or named pipe (excludes -S)
 -S logdir content log: full data to separate files in dir (excludes -L)
 -d daemon mode: run in background, log error messages to syslog
 -D debug mode: run in foreground, log debug messages on stderr
 -V print version information and exit
 -h print usage information and exit
 proxyspec = type listenaddr+port [natengine|targetaddr+port|"sni"+port]
 e.g. http 0.0.0.0 8080 www.roe.ch 80 # http/4; static hostname dst
 https ::1 8443 2001:db8::1 443 # https/6; static address dst
 https 127.0.0.1 9443 sni 443 # https/4; SNI DNS lookups
 tcp 127.0.0.1 10025 # tcp/4; default NAT engine
 ssl 2001:db8::2 9999 pf # ssl/6; NAT engine 'pf'
Example:
 sslsplit -k ca.key -c ca.pem -P https 127.0.0.1 8443 https ::1 8443</code></pre>
</div>
<div style="text-align: justify;">
<code class=" sql"> 
</code></div>
<div style="text-align: justify;">
 </div>
<h3 style="text-align: justify;">
Requirements ::</h3>
<div style="text-align: justify;">
SSLsplit depends on the OpenSSL and libevent 2.x libraries.
The build depends on GNU make and a POSIX.2 environment in <code>PATH</code>.
The (optional) unit tests depend on the check library.</div>
<div style="text-align: justify;">
SSLsplit currently supports the following operating systems and NAT engines:</div>
<ul style="text-align: justify;">
<li>FreeBSD: pf rdr and divert-to, ipfw fwd, ipfilter rdr</li>
<li>OpenBSD: pf rdr-to and divert-to</li>
<li>Linux: netfilter REDIRECT and TPROXY</li>
<li>Mac OS X: ipfw fwd and pf rdr (experimental)</li>
</ul>
<h3>
Download ::</h3>
Linux :: <a href="http://mirror.roe.ch/rel/sslsplit/sslsplit-0.4.8.tar.bz2" target="_blank">SSLsplit v0.4.8</a> (.tar.bz2) 
Official Website :: <a href="http://www.roe.ch/SSLsplit">http://www.roe.ch/SSLsplit</a> <code class=" ruby">
</code>

SSLsplit (MITM Attack against SSL/TLS) :: Tools

SSLsplit is a tool for man-in-the-middle attacks against SSL/TLS encrypted network connections. Connections are transparently interc...