WAF_buster

WAFbuster 通过滥用 SSL/TLS 密码套件来绕过 WAF 关于 WAFbuster 此工具旨在分析 Web 服务器端所使用的 Web 应用防火墙支持的密码套件。参考：https://0x09al.github.io/waf/bypass/ssl/2018/07/02/web-application-firewall-bypass.html。它首先触发 SslScan 来查找与 Web 服务器进行 SSL/TLS 协商时支持的所有密码套件。获取所有支持密码套件的文本文件后，使用 Curl 逐一查询每个密码套件，以检查哪些密码套件不被 WAF 支持但被 Web...

sslscan

SSLScan SSLScan 查询 SSL 服务（如 HTTPS），以确定支持的加密套件。SSLScan 设计为简单、精简且快速。 输出包括 SSL 服务的首选加密套件、证书，并提供文本和 XML 格式。 功能 查询 SSL 服务 支持的加密协议：SSLv2、SSLv3、TLS 1.0、TLS 1.1 和 TLS 1.2（取决于所使用的 OpenSSL 库） 支持 FTP、IMAP、POP3、SMTP 和 XMPP 的 STARTTLS 执行 HTTP 连接 IPv4 和 IPv6 绑定到本地 IP 地址 Python 扩展 文本和 XML 输出 安装 要求： OpenSSL 1.0....

sslscan

sslscan2 sslscan versione 2 è stata ora rilasciata. Include una importante riscrittura del codice di scansione backend, il che significa che non dipende più dalla versione di OpenSSL per molti controlli. Questo permette di supportare protocolli legacy SSLv2 e SSLv3, oltre a supportare TLSv1.3 -...

golismero

What's GoLismero? GoLismero is an open source framework for security testing. It's currently geared towards web security, but it can easily be expanded to other kinds of scans. The most interesting features of the framework are: Real platform independence. Tested on Windows, Linux, BSD and OS X. ...

ssh-audit

ssh-audit ssh-audit is a tool for ssh server & client configuration auditing. jtesta/ssh-audit v2.0+ is the updated and maintained version of ssh-audit forked from arthepsy/ssh-audit v1.x due to inactivity. Features Usage Screenshots Server Standard Audit Example Server Policy Audit Example Clien...

WAF Buster - Disrupt WAF By Abusing SSL/TLS Ciphers

Disrupt WAF by abusing SSL/TLS Ciphers About WAFbuster This tool was created to Analyze the ciphers that are supported by the Web application firewall being used at the web server end. Reference: https://0x09al.github.io/waf/bypass/ssl/2018/07/02/web-application-firewall-bypass.html It works by...

Weblate: Incorrect HTTPS Certificate

Weblate appears to have a public facing git repository located at git.weblate.org that utilises HTTPS when viewed in the browser. As a side note, netcat to port 80 results in the default debian landing page. 77.78.107.252 - git.weblate.org The site has an incorrectly configured certificate, and...

SSLv3 Is Not Disabled When sslProtocol is Set to TLS, Vulnerable to POODLE

The default connector as written in /conf/server.xml uses sslProtocol="TLS". This should only enable TLS connectors, but it also enables SSLv3. Our documentation and the included server.xml need to be updated to reflect the correct settings to enable only TLS. h3. Reproduction steps: Follow the...