Anyone know if there's SSL/TLS testing tools that give output based on NIST standards? Seems everything I've found so far just grades stuff according to the author's own scale (or Qualys, or something else). I need something that is based on NIST SP 800-52r1, or something that can be easily modified to operate as such. Also, native Windows compatibility preferred.
I have become somewhat of a tenable fanboy (and i'm very, very vendor-neutral). I deployed their PVS to augment my N essus and the deployment was simple
@Iszi Basically in terms of scanners like this, you can use Nessus or you can go with acunetix. There might be a way to configure nmap's NSE to determine this stuff..but ..sounds painful.
Yeah, you could roll your own like that. Although, PowerShell sucks for this type of scripting, in terms of man hours spent
The appeal of a PowerShell script or other small(ish) tools is that they're portable - we can hand copies out to whomever needs them instead of having to give them access to a dedicated system.
And if we have to use a dedicated system, Acunetix is a horrible choice - suffers from single-user syndrome.
@Iszi Uhm...no..powershell is portable if you sign it properly and do the whole code signing jazz. Then, it only runs on other powershell systems...and if you don't sign it, you have to set your executionpolicy to none and open up huge holes
I want something I can hand out to system admins & developers and say "here, don't come back to me until this says you've passed". Can't do that with Acunetix.
@Iszi A bash script on the other hand, using nmap or whatever else, is portable into most unix systems and you can have it check for pre-requisites and instal those via package management first. Powershell can't do that.
@Herringbone_Cat Oh, I know I'm probably applying the butt-end of a screwdriver for a hammer here. Gotta work with what I've got, and what I know will be accepted.
What it comes down to is the basic MS conundrum: People use windows because people know Windows.
In most cases, the best tools are Linux. But it's harder to find Linux engineers than MCSE's, although that is changing.
Ask any organization running IIS as a webserver why they don't use nginx or apache, and they say, no linux people in house.
There's also some kind of spiritual belief that pervades Microsoft engineers that the command line, or "UNIX" (as they still refer to POSIX-compliant OSes like BSD or Linux) is this crazy parallel dimension that is intimidating and scary and not for them
e.g. I run ArchLinux on my desktop. Microsoft people are like "What is this!?? OOh that's UNIX. How do you use that ever day? Wow."
@Herringbone_Cat What's real fun are the ones (on Windows) who are using Apache or something other than IIS... and then wonder why their website is still showing SSL/TLS configuration issues after they've configured SCHANNEL appropriately.
And then you go and do some of their research for them, and come to find out their application is using OpenSSL 0.9.8. So, no TLS 1.1/1.2 for them without getting an upgrade.
@DavidFreitag At least you didn't have to get people to use Excel isntead of Access :)
And then one time I installed a real accounting system with a proprietary database (Advent Geneva) at a hedge fun dand their accountant decided to use excel instead
$2b in capital across all sorts of ridiculous investments and equities/options/derivatives all managed by one dude with excel
@Herringbone_Cat At least you didn't have to stop working in engineering for the past to weeks to return to the assembly floor because an employee suddenly up and quit.
We all know the saying there is no one hundred percent security when it comes to computers or perhaps anything but why is it always a vulnerability in every system will the number of Black Hat HACKERS/Crackers increase or decrease in the future?
The famous so-called virus-and-hacker-free Mac is a thing of the past: As it gets more popular it gets more vulnerabilities. Will Linux be the same at some point in time? Is it getting less of more secure?
No computer or network system is 100 percent secure. There is always a vulnerability in ev...
I don't know if this was "the" official use case but the following produces a warning in Java (that can further produce compile errors if mixed with return statements, leading to unreachable code):
if(1 == 2) {
System.out.println("Unreachable code");
}
However this is legal:
if(isUserAGoa...
I don't know if this was "the" official use case but the following produces a warning in Java (that can further produce compile errors if mixed with return statements, leading to unreachable code):
if(1 == 2) {
System.out.println("Unreachable code");
}
However this is legal:
if(isUserAGoa...
