DeepViolet Beta 5.1.16 releases: introspection of SSL\TLS sessions

by do son · Published · Updated

DeepViolet

OWASP DeepViolet TLS/SSL API

DeepViolet is a TLS/SSL scanning API written in Java. To keep DeepViolet easy to use, identify bugs, reference implementations have been developed that consume the API. If you want to see what DeepViolet can do, use it from the command line in your scripts or use the graphical tool from the comfort of your desktop. Both tools can be used to scan HTTPS web servers to check server certificate trust chains, revocation status, check certificates for pending expiration, weak signing algorithms and much more.

BENEFITS This tool helps you understand the state of X.509 certificates run on servers. Some ideas you may find useful.

  • Assess revocation status
  • Certificates signed with weak signing algorithms
  • Weak cipher suits on the web server
  • Warn on certificates with approaching expiration
  • View X.509 certificate metadata
  • Easily visualize X.509 trust chains
  • Explore trust chains, flag self-signed roots
  • Information to support forensics
  • and more…

Already great tools exist today for TLS/SSL scanning like Qualys Labs, Mozilla Observatory, OpenSSL. Why do I care about DeepViolet? A valid question and one I asked myself. Originally, DeepViolet was written as an educational tool. A tool to learn TLS/SSL protocols and some of the issues around recent attack trends better. The goal was not to develop a TLS/SSL scanner and compete with existing powerful tools. However, it turns out there are few choices for easy to use open source Java TLS/SSL scanning APIs. What better way to learn TLS/SSL and provide other scanning projects with a Java-friendly API scanning solution – the DeepViolet project was born.

Changelog v Beta 5.1.16

Summary

  • Fix bugs w/handling of version handling (e.g., dvversion)
  • Misc improvements to project/build files (e.g., .gitignore)
  • Various improvements to the build process to support publishing artifacts to Maven Central

Note(s):
N1 – isDeepVioletSnapShot() does not return the correct state occasionally. Fixed in the snapshot build.

Download

Tutorial

Copyright 2016 Milton Smith

Source: https://github.com/spoofzu/

Tags: DeepViolet