From 0106abd529604dcbbe3c00b88444d9db9cfb8010 Mon Sep 17 00:00:00 2001 From: yzninja Date: Wed, 11 Feb 2015 15:54:55 +0800 Subject: [PATCH 1/9] Create supported_attacks This is just the initial version of the document. I still need to add changes to the text (from Chad) and will add more descriptions as I use more and review the source code. --- docs/supported_attacks | 42 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 42 insertions(+) create mode 100644 docs/supported_attacks diff --git a/docs/supported_attacks b/docs/supported_attacks new file mode 100644 index 00000000..c639dff6 --- /dev/null +++ b/docs/supported_attacks @@ -0,0 +1,42 @@ + + +Connection Handlers +Each of the handlers detects a specific TLS/SSL vulnerability. The available data handlers are available are: +• droptls - Drops TLS connections but lets SSLv3 connections through +• selfsigned - Attempts to MiTM using a self-signed certificate for the requested domain. +NOTE. Requires a self-signed certificate to be generated +• clientheartbleed - Sends a heartbleed message to the client during the SSL handshake +• anonserver - Attempts to MiTM connections that accept anonymous/unauthenticated server. +• dropssl - Drops SSL connections +• invalidhostname - Attempts to MiTM using a valid certificate for another domain. +NOTE: The certificate used for testing must have the path “./trusted-cert.pem” and have a valid cert and private key. +• earlyccs - Tests for OpenSSL early CCS vulnerability(CVE-2014-0224) +Data Handlers +The available data handlers are available are: +• imapstarttlsstrip - Suppress STARTTLS in IMAP +• httpauthdetection - Detect authorization headers in HTTP requests +• imagereplace - Replace responses with Content-Type of image/* with ./replace.png +• customrequest - Detect client specified regexs in requests +• weaktlsversiondetection - Detect versions of the TLS/SSL protocols that are known to be weak. +Output log (-l) [ERROR] messages occur when the following conditions are detected: + o SSLv3 without support for TLS_FALLBACK_SCSV i.e. the POODLE vulnerability https://www.imperialviolet.org/2014/10/14/poodle.html + o SSLv2 +Output log [WARNING] messages occur when: + o SSLv3 with TLS_FALLBACK_SCSV supported + +• insecurecipherdetection - Detect insecure cipher suites in TLS Client Hellos. +Output log (-l) [ERROR] messages occur when the following conditions are detected: + o Anonymous (asymmetric encryption) ciphers, + o No or NULL asymmetric encryption, symmetric encryption, or + o no integrity algorithm (message authentication code) is specified in the cipher suite. +• blockhttp - Block HTTP traffic +• disablecdcpencryption - Disable Chrome Data Compression Proxy encryption +• sslstrip - Runs sslstrip on http traffic. Detects when sslstrip'd urls are visited. +• httpdetection - Detects plaintext HTTP requests i.e. not using SSL/TLS. +• xmppstarttlsstrip - Suppress STARTTLS in XMPP streams +• rawlogger - Log raw traffic to the traffic log +• androidwebviewjsrce - Detect Android Webview Javascript RCE +• xmppauthdetection - Detect authentication credentials in XMPP traffic +• smtpstarttlsstrip - Suppress STARTTLS in SMTP +• smtpauthdetection - Detect authentication credentials in SMTP traffic +• imapauthdetection - Detect authentication credentials in IMAP traffic From 00f06b70665625f80ac7cadaf85b005552cb7519 Mon Sep 17 00:00:00 2001 From: yzninja Date: Wed, 11 Feb 2015 15:56:54 +0800 Subject: [PATCH 2/9] Rename supported_attacks to supported_attacks.md --- docs/{supported_attacks => supported_attacks.md} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename docs/{supported_attacks => supported_attacks.md} (100%) diff --git a/docs/supported_attacks b/docs/supported_attacks.md similarity index 100% rename from docs/supported_attacks rename to docs/supported_attacks.md From 1c56f998dade92c3e4ffdcd82c5cb5676e7bac6d Mon Sep 17 00:00:00 2001 From: yzninja Date: Wed, 11 Feb 2015 15:59:05 +0800 Subject: [PATCH 3/9] Added .md extension to filename. ... --- docs/supported_attacks.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/supported_attacks.md b/docs/supported_attacks.md index c639dff6..b15716fc 100644 --- a/docs/supported_attacks.md +++ b/docs/supported_attacks.md @@ -39,4 +39,4 @@ Output log (-l) [ERROR] messages occur when the following conditions are detecte • xmppauthdetection - Detect authentication credentials in XMPP traffic • smtpstarttlsstrip - Suppress STARTTLS in SMTP • smtpauthdetection - Detect authentication credentials in SMTP traffic -• imapauthdetection - Detect authentication credentials in IMAP traffic +• imapauthdetection - Detect authentication credentials in IMAP traffic. From 98ba9de0d8403b1a028a0bf9b011c0f111a87800 Mon Sep 17 00:00:00 2001 From: yzninja Date: Wed, 11 Feb 2015 23:39:00 +0800 Subject: [PATCH 4/9] Update supported_attacks.md I added some more output log descriptions, and the "serverkeyreplace" connection handler item. --- docs/supported_attacks.md | 95 +++++++++++++++++++++++---------------- 1 file changed, 57 insertions(+), 38 deletions(-) diff --git a/docs/supported_attacks.md b/docs/supported_attacks.md index b15716fc..0d73aa09 100644 --- a/docs/supported_attacks.md +++ b/docs/supported_attacks.md @@ -1,42 +1,61 @@ +# Supported Attacks +Each of the handlers attempts to exploit a specific TLS/SSL vulnerability. +There are two types of TLS handlers by nogotofail: ++ handlers which test for vulnerabilities allowing insecure **connections**, and ++ handlers which detect or exploit vulnerabilites impacting the security of **data** +Handlers write [WARNING], [ERROR] or [CRITICAL] messages to the output log (-l) based on the severity. -Connection Handlers -Each of the handlers detects a specific TLS/SSL vulnerability. The available data handlers are available are: -• droptls - Drops TLS connections but lets SSLv3 connections through -• selfsigned - Attempts to MiTM using a self-signed certificate for the requested domain. -NOTE. Requires a self-signed certificate to be generated -• clientheartbleed - Sends a heartbleed message to the client during the SSL handshake -• anonserver - Attempts to MiTM connections that accept anonymous/unauthenticated server. -• dropssl - Drops SSL connections -• invalidhostname - Attempts to MiTM using a valid certificate for another domain. -NOTE: The certificate used for testing must have the path “./trusted-cert.pem” and have a valid cert and private key. -• earlyccs - Tests for OpenSSL early CCS vulnerability(CVE-2014-0224) -Data Handlers +##Connection Handlers The available data handlers are available are: -• imapstarttlsstrip - Suppress STARTTLS in IMAP -• httpauthdetection - Detect authorization headers in HTTP requests -• imagereplace - Replace responses with Content-Type of image/* with ./replace.png -• customrequest - Detect client specified regexs in requests -• weaktlsversiondetection - Detect versions of the TLS/SSL protocols that are known to be weak. -Output log (-l) [ERROR] messages occur when the following conditions are detected: - o SSLv3 without support for TLS_FALLBACK_SCSV i.e. the POODLE vulnerability https://www.imperialviolet.org/2014/10/14/poodle.html - o SSLv2 -Output log [WARNING] messages occur when: - o SSLv3 with TLS_FALLBACK_SCSV supported ++ droptls - Drops TLS connections but lets SSLv3 connections through ++ selfsigned - Attempts to MiTM using a self-signed certificate for the requested domain. + An output log [CRITICAL] message appears when a self-signed certificate is accepted by an app. ++ clientheartbleed - Sends a heartbleed message to the client during the SSL handshake + An output log [CRITICAL] message appears when a Heartbleed response is received ++ anonserver - Attempts to MiTM connections that accept anonymous/unauthenticated server. ++ dropssl - Drops SSL connections ++ invalidhostname - Attempts to MiTM using a valid certificate for another domain. + NOTE: The certificate used for testing must have the path “./trusted-cert.pem” and have a valid cert and private key. ++ earlyccs - Tests for OpenSSL early CCS vulnerability(CVE-2014-0224) + An output log [CRITICAL] message appears when the client is vulnerable to the Early CCS attack. ++ serverkeyreplace - Tests for clients vulnerable to SSL server key substitution + An output log [CRITICAL] message appears when the client is vulnerable to the server key substitution attack. -• insecurecipherdetection - Detect insecure cipher suites in TLS Client Hellos. -Output log (-l) [ERROR] messages occur when the following conditions are detected: - o Anonymous (asymmetric encryption) ciphers, - o No or NULL asymmetric encryption, symmetric encryption, or - o no integrity algorithm (message authentication code) is specified in the cipher suite. -• blockhttp - Block HTTP traffic -• disablecdcpencryption - Disable Chrome Data Compression Proxy encryption -• sslstrip - Runs sslstrip on http traffic. Detects when sslstrip'd urls are visited. -• httpdetection - Detects plaintext HTTP requests i.e. not using SSL/TLS. -• xmppstarttlsstrip - Suppress STARTTLS in XMPP streams -• rawlogger - Log raw traffic to the traffic log -• androidwebviewjsrce - Detect Android Webview Javascript RCE -• xmppauthdetection - Detect authentication credentials in XMPP traffic -• smtpstarttlsstrip - Suppress STARTTLS in SMTP -• smtpauthdetection - Detect authentication credentials in SMTP traffic -• imapauthdetection - Detect authentication credentials in IMAP traffic. +##Data Handlers +The available data handlers are available are: ++ imapstarttlsstrip - Suppress STARTTLS in IMAP ++ httpauthdetection - Detect authorization headers in HTTP requests + An output log [CRITICAL] message appears when an Authorization header is found in a request. ++ imagereplace - Replace responses with Content-Type of image/* with ./replace.png ++ customrequest - Detect client specified regexs in requests ++ weaktlsversiondetection - Detect versions of the TLS/SSL protocols that are known to be weak. + An output log [CRITICAL] message appears when: + + SSLv3 is used without support for TLS_FALLBACK_SCSV, or i.e. the POODLE vulnerability https://www.imperialviolet.org/2014/10/14/poodle.html + + SSLv2 is detected + Output log [WARNING] messages occur when SSLv3 is used with TLS_FALLBACK_SCSV supported ++ insecurecipherdetection - Detect insecure cipher suites in TLS Client Hellos. + Output log (-l) [ERROR] messages occur when the following conditions are detected: + + anonymous (asymmetric encryption) ciphers, + + no or NULL asymmetric encryption, symmetric encryption, or + + no integrity algorithm (message authentication code) is specified in the cipher suite. ++ blockhttp - Block HTTP traffic ++ disablecdcpencryption - Disable Chrome Data Compression Proxy encryption ++ sslstrip - Runs sslstrip on http traffic. Detects when sslstrip'd urls are visited. + An output log [CRITICAL] message appears when the client visits a SSLStrip'd URL. ++ httpdetection - Detects plaintext HTTP requests i.e. not using SSL/TLS. ++ xmppstarttlsstrip - Suppress STARTTLS in XMPP streams ++ rawlogger - Log raw traffic to the traffic log ++ androidwebviewjsrce - Detect Android Webview Javascript RCE + An output log [CRITICAL] message appears when the client is found to be vulnerable to the Webview Javascript RCE exploit. + ++ xmppauthdetection - Detect authentication credentials in XMPP traffic + An output log [ERROR] message appears when credentials are detect in XMPP traffic. + Output log [WARNING] messages appear when: + + the XMPP STARTTLS feature is missing, or + + the handler failed to strip XMPP STARTTLS ++ smtpstarttlsstrip - Suppress STARTTLS in SMTP + An output log [CRITICAL] message appears when cleartext SMTP traffic is found after STARTTLS is stripped. ++ smtpauthdetection - Detect authentication credentials in SMTP traffic ++ imapauthdetection - Detect authentication credentials in IMAP traffic. + An output [CRITICAL] message appears when credentials are found in cleartext IMAP traffic. From 651ee8aaae262db3c1a5d9c75ceb8a1cc156b646 Mon Sep 17 00:00:00 2001 From: yzninja Date: Wed, 11 Feb 2015 23:39:54 +0800 Subject: [PATCH 5/9] Update supported_attacks.md Typo fix. --- docs/supported_attacks.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/supported_attacks.md b/docs/supported_attacks.md index 0d73aa09..df349f4b 100644 --- a/docs/supported_attacks.md +++ b/docs/supported_attacks.md @@ -2,7 +2,7 @@ Each of the handlers attempts to exploit a specific TLS/SSL vulnerability. There are two types of TLS handlers by nogotofail: + handlers which test for vulnerabilities allowing insecure **connections**, and -+ handlers which detect or exploit vulnerabilites impacting the security of **data** ++ handlers which detect or exploit vulnerabilites affecting **data** security. Handlers write [WARNING], [ERROR] or [CRITICAL] messages to the output log (-l) based on the severity. From 28220b7fb1afb37466f3fce6b53427d718495d1f Mon Sep 17 00:00:00 2001 From: yzninja Date: Wed, 11 Feb 2015 23:41:32 +0800 Subject: [PATCH 6/9] Update supported_attacks.md More typo fixes --- docs/supported_attacks.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/supported_attacks.md b/docs/supported_attacks.md index df349f4b..313b2ea7 100644 --- a/docs/supported_attacks.md +++ b/docs/supported_attacks.md @@ -35,7 +35,7 @@ The available data handlers are available are: + SSLv2 is detected Output log [WARNING] messages occur when SSLv3 is used with TLS_FALLBACK_SCSV supported + insecurecipherdetection - Detect insecure cipher suites in TLS Client Hellos. - Output log (-l) [ERROR] messages occur when the following conditions are detected: + Output log [ERROR] messages appear when one of the following conditions is detected: + anonymous (asymmetric encryption) ciphers, + no or NULL asymmetric encryption, symmetric encryption, or + no integrity algorithm (message authentication code) is specified in the cipher suite. From 2ed5d314ad21841906f9b32fe6398ee9ac12df53 Mon Sep 17 00:00:00 2001 From: yzninja Date: Thu, 12 Feb 2015 23:10:53 +0800 Subject: [PATCH 7/9] Update supported_attacks.md Improved output log message information and formatting. --- docs/supported_attacks.md | 52 ++++++++++++++++++++++----------------- 1 file changed, 30 insertions(+), 22 deletions(-) diff --git a/docs/supported_attacks.md b/docs/supported_attacks.md index 313b2ea7..751f32ee 100644 --- a/docs/supported_attacks.md +++ b/docs/supported_attacks.md @@ -10,52 +10,60 @@ Handlers write [WARNING], [ERROR] or [CRITICAL] messages to the output log (-l) The available data handlers are available are: + droptls - Drops TLS connections but lets SSLv3 connections through + selfsigned - Attempts to MiTM using a self-signed certificate for the requested domain. - An output log [CRITICAL] message appears when a self-signed certificate is accepted by an app. + Output log messages generated: + + [CRITICAL] when a self-signed certificate is accepted by an app. + clientheartbleed - Sends a heartbleed message to the client during the SSL handshake - An output log [CRITICAL] message appears when a Heartbleed response is received + Output log messages generated: + + [CRITICAL] when a Heartbleed response is received + anonserver - Attempts to MiTM connections that accept anonymous/unauthenticated server. + dropssl - Drops SSL connections + invalidhostname - Attempts to MiTM using a valid certificate for another domain. NOTE: The certificate used for testing must have the path “./trusted-cert.pem” and have a valid cert and private key. + earlyccs - Tests for OpenSSL early CCS vulnerability(CVE-2014-0224) - An output log [CRITICAL] message appears when the client is vulnerable to the Early CCS attack. + Output log messages generated: + + [CRITICAL] when the client is vulnerable to the Early CCS attack + serverkeyreplace - Tests for clients vulnerable to SSL server key substitution - An output log [CRITICAL] message appears when the client is vulnerable to the server key substitution attack. + Output log messages generated: + + [CRITICAL] when the client is vulnerable to the server key substitution attack ##Data Handlers The available data handlers are available are: + imapstarttlsstrip - Suppress STARTTLS in IMAP + httpauthdetection - Detect authorization headers in HTTP requests - An output log [CRITICAL] message appears when an Authorization header is found in a request. + Output log messages generated: + + [CRITICAL] when an Authorization header is found in a request + imagereplace - Replace responses with Content-Type of image/* with ./replace.png + customrequest - Detect client specified regexs in requests + weaktlsversiondetection - Detect versions of the TLS/SSL protocols that are known to be weak. - An output log [CRITICAL] message appears when: - + SSLv3 is used without support for TLS_FALLBACK_SCSV, or i.e. the POODLE vulnerability https://www.imperialviolet.org/2014/10/14/poodle.html - + SSLv2 is detected - Output log [WARNING] messages occur when SSLv3 is used with TLS_FALLBACK_SCSV supported + Output log messages generated: + + [CRITICAL] SSLv3 is used without support for TLS_FALLBACK_SCSV, or i.e. the POODLE vulnerability https://www.imperialviolet.org/2014/10/14/poodle.html + + [CRITICAL] SSLv2 is detected + + [WARNING] SSLv3 is used with TLS_FALLBACK_SCSV supported + insecurecipherdetection - Detect insecure cipher suites in TLS Client Hellos. - Output log [ERROR] messages appear when one of the following conditions is detected: - + anonymous (asymmetric encryption) ciphers, - + no or NULL asymmetric encryption, symmetric encryption, or - + no integrity algorithm (message authentication code) is specified in the cipher suite. + Output log messages generated: + + [ERROR] Use of anonymous (asymmetric encryption) in the cipher suite + + [ERROR] NULL asymmetric encryption or symmetric encryption in the cipher suite + + [ERROR] no integrity algorithm (message authentication code) is specified in the cipher suite. + blockhttp - Block HTTP traffic + disablecdcpencryption - Disable Chrome Data Compression Proxy encryption + sslstrip - Runs sslstrip on http traffic. Detects when sslstrip'd urls are visited. - An output log [CRITICAL] message appears when the client visits a SSLStrip'd URL. + Output log messages generated: + + [CRITICAL] client visits a SSLStrip'd URL. + httpdetection - Detects plaintext HTTP requests i.e. not using SSL/TLS. + xmppstarttlsstrip - Suppress STARTTLS in XMPP streams + rawlogger - Log raw traffic to the traffic log + androidwebviewjsrce - Detect Android Webview Javascript RCE - An output log [CRITICAL] message appears when the client is found to be vulnerable to the Webview Javascript RCE exploit. - + Output log messages generated: + + [CRITICAL] client is vulnerable to the Webview Javascript RCE exploit + xmppauthdetection - Detect authentication credentials in XMPP traffic - An output log [ERROR] message appears when credentials are detect in XMPP traffic. - Output log [WARNING] messages appear when: - + the XMPP STARTTLS feature is missing, or - + the handler failed to strip XMPP STARTTLS + Output log messages generated: + + [ERROR] credentials are detected in XMPP traffic + + [WARNING] XMPP STARTTLS feature is missing + + [WARNING] handler failed to strip XMPP STARTTLS + smtpstarttlsstrip - Suppress STARTTLS in SMTP - An output log [CRITICAL] message appears when cleartext SMTP traffic is found after STARTTLS is stripped. + Output log messages generated: + + [CRITICAL] cleartext SMTP traffic is detected after STARTTLS is stripped + smtpauthdetection - Detect authentication credentials in SMTP traffic + imapauthdetection - Detect authentication credentials in IMAP traffic. - An output [CRITICAL] message appears when credentials are found in cleartext IMAP traffic. + Output log messages generated: + + [CRITICAL] credentials are detected in cleartext IMAP traffic. From f6b16d2d30aaa687fab9a0a8e3cb0822804a8a0e Mon Sep 17 00:00:00 2001 From: yzninja Date: Thu, 12 Feb 2015 23:53:39 +0800 Subject: [PATCH 8/9] Update supported_attacks.md Added some missing [CRITICAL] and [WARNING] messages. --- docs/supported_attacks.md | 57 ++++++++++++++++++++++++--------------- 1 file changed, 35 insertions(+), 22 deletions(-) diff --git a/docs/supported_attacks.md b/docs/supported_attacks.md index 751f32ee..c31b7c67 100644 --- a/docs/supported_attacks.md +++ b/docs/supported_attacks.md @@ -4,41 +4,46 @@ There are two types of TLS handlers by nogotofail: + handlers which test for vulnerabilities allowing insecure **connections**, and + handlers which detect or exploit vulnerabilites affecting **data** security. -Handlers write [WARNING], [ERROR] or [CRITICAL] messages to the output log (-l) based on the severity. +Handlers write [WARNING], [ERROR] or [CRITICAL] security issues to the output log (-l) based on the their severity. ##Connection Handlers The available data handlers are available are: + droptls - Drops TLS connections but lets SSLv3 connections through + selfsigned - Attempts to MiTM using a self-signed certificate for the requested domain. Output log messages generated: - + [CRITICAL] when a self-signed certificate is accepted by an app. -+ clientheartbleed - Sends a heartbleed message to the client during the SSL handshake + + [CRITICAL] Client accepts self-signed certificate and creates connection ++ clientheartbleed - Sends a heartbleed message to the client during the SSL handshake. Output log messages generated: - + [CRITICAL] when a Heartbleed response is received + + [CRITICAL] Client returns a Heartbleed response + anonserver - Attempts to MiTM connections that accept anonymous/unauthenticated server. + Output log messages generated: + + [CRITICAL] Client accepts server certificate certificate and creates connection + dropssl - Drops SSL connections + invalidhostname - Attempts to MiTM using a valid certificate for another domain. NOTE: The certificate used for testing must have the path “./trusted-cert.pem” and have a valid cert and private key. + earlyccs - Tests for OpenSSL early CCS vulnerability(CVE-2014-0224) Output log messages generated: + [CRITICAL] when the client is vulnerable to the Early CCS attack -+ serverkeyreplace - Tests for clients vulnerable to SSL server key substitution ++ serverkeyreplace - Tests for clients vulnerable to SSL server key substitution. Output log messages generated: - + [CRITICAL] when the client is vulnerable to the server key substitution attack + + [CRITICAL] Client is vulnerable to the server key substitution attack ##Data Handlers The available data handlers are available are: -+ imapstarttlsstrip - Suppress STARTTLS in IMAP -+ httpauthdetection - Detect authorization headers in HTTP requests ++ imapstarttlsstrip - Suppress STARTTLS in IMAP. + Output log messages generated: + + [CRITICAL] Cleartext traffic appears after STARTTLS is stripped ++ httpauthdetection - Detect authorization headers in HTTP requests. Output log messages generated: - + [CRITICAL] when an Authorization header is found in a request + + [CRITICAL] Authorization header in request from client + imagereplace - Replace responses with Content-Type of image/* with ./replace.png + customrequest - Detect client specified regexs in requests + weaktlsversiondetection - Detect versions of the TLS/SSL protocols that are known to be weak. Output log messages generated: + [CRITICAL] SSLv3 is used without support for TLS_FALLBACK_SCSV, or i.e. the POODLE vulnerability https://www.imperialviolet.org/2014/10/14/poodle.html - + [CRITICAL] SSLv2 is detected - + [WARNING] SSLv3 is used with TLS_FALLBACK_SCSV supported + + [ERROR] Client enabled SSLv2 protocol + + [ERROR] Client enabled SSLv3 protocol without TLS_FALLBACK_SCSV + + [WARNING] Client enabled SSLv3 protocol with TLS_FALLBACK_SCSV + insecurecipherdetection - Detect insecure cipher suites in TLS Client Hellos. Output log messages generated: + [ERROR] Use of anonymous (asymmetric encryption) in the cipher suite @@ -48,22 +53,30 @@ The available data handlers are available are: + disablecdcpencryption - Disable Chrome Data Compression Proxy encryption + sslstrip - Runs sslstrip on http traffic. Detects when sslstrip'd urls are visited. Output log messages generated: - + [CRITICAL] client visits a SSLStrip'd URL. + + [CRITICAL] Client detected visiting an SSLStrip'd URL + httpdetection - Detects plaintext HTTP requests i.e. not using SSL/TLS. + Output log messages generated: + + [ERROR] Client HTTP request detected + xmppstarttlsstrip - Suppress STARTTLS in XMPP streams + Output log messages generated: + + [CRITICAL] Cleartext traffic is detected after stripped STARTTLS + + [WARNING] XMPP STARTTLS feature missing + + [WARNING] Failed to strip XMPP STARTTLS + rawlogger - Log raw traffic to the traffic log -+ androidwebviewjsrce - Detect Android Webview Javascript RCE ++ androidwebviewjsrce - Detect Android Webview Javascript RCE. Output log messages generated: - + [CRITICAL] client is vulnerable to the Webview Javascript RCE exploit -+ xmppauthdetection - Detect authentication credentials in XMPP traffic + + [CRITICAL] Client is vulnerable to the Webview Javascript RCE exploit ++ xmppauthdetection - Detect authentication credentials in XMPP traffic. Output log messages generated: - + [ERROR] credentials are detected in XMPP traffic - + [WARNING] XMPP STARTTLS feature is missing - + [WARNING] handler failed to strip XMPP STARTTLS -+ smtpstarttlsstrip - Suppress STARTTLS in SMTP + + [CRITICAL] Authentication credentials detected in XMPP traffic + + [ERROR] Credentials are detected in XMPP traffic + + [WARNING] XMPP STARTTLS feature is missing + + [WARNING] Handler failed to strip XMPP STARTTLS ++ smtpstarttlsstrip - Suppress STARTTLS in SMTP. Output log messages generated: - + [CRITICAL] cleartext SMTP traffic is detected after STARTTLS is stripped -+ smtpauthdetection - Detect authentication credentials in SMTP traffic + + [CRITICAL] Cleartext SMTP traffic detected after STARTTLS is stripped ++ smtpauthdetection - Detect authentication credentials in SMTP traffic. + + [CRITICAL] Authentication credentials detected in SMTP traffic + imapauthdetection - Detect authentication credentials in IMAP traffic. Output log messages generated: - + [CRITICAL] credentials are detected in cleartext IMAP traffic. + + [CRITICAL] Credentials are detected in cleartext IMAP traffic. From 2f576b523bc4e7d2e56ce631719d2555bc4ee94a Mon Sep 17 00:00:00 2001 From: yzninja Date: Thu, 12 Feb 2015 23:56:38 +0800 Subject: [PATCH 9/9] Update supported_attacks.md Fixed message wording and missing periods. --- docs/supported_attacks.md | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/docs/supported_attacks.md b/docs/supported_attacks.md index c31b7c67..f0ae06db 100644 --- a/docs/supported_attacks.md +++ b/docs/supported_attacks.md @@ -7,7 +7,7 @@ There are two types of TLS handlers by nogotofail: Handlers write [WARNING], [ERROR] or [CRITICAL] security issues to the output log (-l) based on the their severity. ##Connection Handlers -The available data handlers are available are: +List of available connection handlers and output log messages generated: + droptls - Drops TLS connections but lets SSLv3 connections through + selfsigned - Attempts to MiTM using a self-signed certificate for the requested domain. Output log messages generated: @@ -21,7 +21,7 @@ The available data handlers are available are: + dropssl - Drops SSL connections + invalidhostname - Attempts to MiTM using a valid certificate for another domain. NOTE: The certificate used for testing must have the path “./trusted-cert.pem” and have a valid cert and private key. -+ earlyccs - Tests for OpenSSL early CCS vulnerability(CVE-2014-0224) ++ earlyccs - Tests for OpenSSL early CCS vulnerability(CVE-2014-0224). Output log messages generated: + [CRITICAL] when the client is vulnerable to the Early CCS attack + serverkeyreplace - Tests for clients vulnerable to SSL server key substitution. @@ -29,15 +29,15 @@ The available data handlers are available are: + [CRITICAL] Client is vulnerable to the server key substitution attack ##Data Handlers -The available data handlers are available are: +List of available data handlers and output log messages generated: + imapstarttlsstrip - Suppress STARTTLS in IMAP. Output log messages generated: + [CRITICAL] Cleartext traffic appears after STARTTLS is stripped + httpauthdetection - Detect authorization headers in HTTP requests. Output log messages generated: + [CRITICAL] Authorization header in request from client -+ imagereplace - Replace responses with Content-Type of image/* with ./replace.png -+ customrequest - Detect client specified regexs in requests ++ imagereplace - Replace responses with Content-Type of image/* with ./replace.png. ++ customrequest - Detect client specified regexs in requests. + weaktlsversiondetection - Detect versions of the TLS/SSL protocols that are known to be weak. Output log messages generated: + [CRITICAL] SSLv3 is used without support for TLS_FALLBACK_SCSV, or i.e. the POODLE vulnerability https://www.imperialviolet.org/2014/10/14/poodle.html @@ -49,15 +49,15 @@ The available data handlers are available are: + [ERROR] Use of anonymous (asymmetric encryption) in the cipher suite + [ERROR] NULL asymmetric encryption or symmetric encryption in the cipher suite + [ERROR] no integrity algorithm (message authentication code) is specified in the cipher suite. -+ blockhttp - Block HTTP traffic -+ disablecdcpencryption - Disable Chrome Data Compression Proxy encryption ++ blockhttp - Block HTTP traffic. ++ disablecdcpencryption - Disable Chrome Data Compression Proxy encryption. + sslstrip - Runs sslstrip on http traffic. Detects when sslstrip'd urls are visited. Output log messages generated: + [CRITICAL] Client detected visiting an SSLStrip'd URL + httpdetection - Detects plaintext HTTP requests i.e. not using SSL/TLS. Output log messages generated: + [ERROR] Client HTTP request detected -+ xmppstarttlsstrip - Suppress STARTTLS in XMPP streams ++ xmppstarttlsstrip - Suppress STARTTLS in XMPP streams. Output log messages generated: + [CRITICAL] Cleartext traffic is detected after stripped STARTTLS + [WARNING] XMPP STARTTLS feature missing