DeepViolet Beta 5.1.16 releases: introspection of SSL\TLS sessions

by do son · Published August 14, 2018 · Updated August 14, 2018

OWASP DeepViolet TLS/SSL API

DeepViolet is a TLS/SSL scanning API written in Java. To keep DeepViolet easy to use, identify bugs, reference implementations have been developed that consume the API. If you want to see what DeepViolet can do, use it from the command line in your scripts or use the graphical tool from the comfort of your desktop. Both tools can be used to scan HTTPS web servers to check server certificate trust chains, revocation status, check certificates for pending expiration, weak signing algorithms and much more.

BENEFITS This tool helps you understand the state of X.509 certificates run on servers. Some ideas you may find useful.

Assess revocation status
Certificates signed with weak signing algorithms
Weak cipher suits on the web server
Warn on certificates with approaching expiration
View X.509 certificate metadata
Easily visualize X.509 trust chains
Explore trust chains, flag self-signed roots
Information to support forensics
and more…

Already great tools exist today for TLS/SSL scanning like Qualys Labs, Mozilla Observatory, OpenSSL. Why do I care about DeepViolet? A valid question and one I asked myself. Originally, DeepViolet was written as an educational tool. A tool to learn TLS/SSL protocols and some of the issues around recent attack trends better. The goal was not to develop a TLS/SSL scanner and compete with existing powerful tools. However, it turns out there are few choices for easy to use open source Java TLS/SSL scanning APIs. What better way to learn TLS/SSL and provide other scanning projects with a Java-friendly API scanning solution – the DeepViolet project was born.

Changelog v Beta 5.1.16

Summary

Fix bugs w/handling of version handling (e.g., dvversion)
Misc improvements to project/build files (e.g., .gitignore)
Various improvements to the build process to support publishing artifacts to Maven Central

Note(s):
N1 – isDeepVioletSnapShot() does not return the correct state occasionally. Fixed in the snapshot build.

Download

Tutorial