GO KALI FREE

testssl.sh

Vulnerability Analysis

Intermediatelow risk

testssl.sh is a free command-line tool which checks a server's service on any port for support of TLS/SSL ciphers, protocols as well as cryptographic flaws and vulnerabilities.

Installation

sudo apt install testssl.sh

Basic Syntax

testssl.sh <options> <URI>

Quick Facts

Full Name
testssl.sh
License
GPL
Language
Bash
Ciphers
300+ supported
Category
SSL/TLS Scanner
Speed
Thorough

Tool Overview

testssl.sh is a free command-line tool that checks a server's service on any port for support of TLS/SSL ciphers, protocols, and cryptographic flaws. It provides comprehensive testing with detailed output.

The tool tests for over 300 cipher suites, protocol versions, and known vulnerabilities including Heartbleed, POODLE, BEAST, ROBOT, and more. It supports HTML, CSV, JSON, and XML output formats.

testssl.sh is the most comprehensive SSL/TLS scanner available, providing compliance-ready reports and detailed security assessments. It is slower but more thorough than SSLScan.

Common Commands

testssl.sh example.comFull configuration profile - Run a complete diagnostic checking certificates, ciphers, and classic vulnerabilities
testssl example.comFull SSL test
testssl --vulnerable example.comVulnerability check
testssl -p example.comProtocol check only
testssl --html example.comHTML report
testssl example.comFull SSL/TLS test
testssl --sni example.comTest with SNI
testssl --ip one 192.168.1.100Test single IP
testssl -p example.comShow ports and protocols
testssl -U example.comCheck for known vulnerabilities
testssl --jsonfile results.json example.comJSON output
testssl --csvfile results.csv example.comCSV output
testssl --htmlfile results.html example.comHTML report
testssl --xmlfile results.xml example.comXML output
testssl --severity LOW example.comFilter by severity

Step-by-Step Guide

  1. 1Initiate testssl against your target endpoint
  2. 2Allow the comprehensive script to run through its full diagnostic suite
  3. 3Check the color-coded output for protocol strengths and weaknesses
  4. 4Scroll to the vulnerability module to see if the server is susceptible to known crypto attacks
  5. 5Create an HTML export file for your documentation

Use Cases

Deep SSL Audit

Comprehensive testing of SSL/TLS configurations.

Compliance Check

Verify SSL/TLS meets PCI DSS, HIPAA, and other standards.

Vulnerability Detection

Detect all known SSL/TLS vulnerabilities.

Protocol Downgrade

Test for protocol downgrade attacks.

Key Features

Related Tools

SSLScan

Vulnerability Analysis

Fast SSL/TLS cipher scanner.

Nmap

Information Gathering

Network port scanner.

Frequently Asked Questions

What is testssl.sh used for?

testssl.sh is a comprehensive SSL/TLS scanner that checks for cipher suites, protocols, vulnerabilities, and cryptographic flaws. It provides detailed testing for compliance and security assessments.

How does testssl.sh differ from SSLScan?

testssl.sh is more comprehensive, testing for protocol downgrades, specific CVEs, and providing detailed compliance reports. SSLScan is faster for quick cipher checks.

Can testssl.sh detect all SSL vulnerabilities?

testssl.sh tests for over 300 ciphers and checks for Heartbleed, POODLE, BEAST, ROBOT, and many other SSL/TLS vulnerabilities. It is one of the most comprehensive SSL testing tools available.

Does testssl.sh support HTML reports?

Yes, testssl.sh supports HTML, CSV, JSON, and XML output formats for documentation and integration with other tools.

How do I install testssl.sh?

Install testssl.sh using: sudo apt install testssl.sh on Kali Linux. On other systems, clone from GitHub: git clone https://github.com/drwetter/testssl.sh.git.

How do I use testssl.sh for a full scan?

Run testssl.sh example.com to perform a comprehensive SSL/TLS scan. Use --vulnerable to focus on vulnerabilities or -p for protocol-only checks.

What are the most common testssl.sh commands?

Common commands include: testssl.sh target (full scan), testssl.sh --vulnerable target (vulnerabilities), testssl.sh -p target (protocols), testssl.sh --html target (HTML report).

How do I generate an HTML report with testssl.sh?

Use testssl.sh --html target.com to generate an HTML report. Also supports --csv, --json, and --xml formats for different use cases.

Is testssl.sh legal to use?

testssl.sh itself is legal software. However, scanning services without permission from the owner may violate laws. Always obtain written authorization before testing.

What vulnerabilities does testssl.sh detect?

testssl.sh detects Heartbleed, POODLE, BEAST, ROBOT, FREAK, Logjam, DROWN, and many other SSL/TLS vulnerabilities with detailed explanations.

How does testssl.sh compare to SSLScan?

testssl.sh is more comprehensive but slower. SSLScan is faster for quick checks. Use testssl.sh for deep auditing; SSLScan for rapid assessments.

What is the -p flag in testssl.sh?

The -p flag runs protocol-only checks, testing for supported SSL/TLS versions without the full cipher and vulnerability suite. Faster than a full scan.

How long does a testssl.sh scan take?

A full testssl.sh scan takes 2-10 minutes depending on the target. Protocol-only scans (-p) complete in 30-60 seconds.

What does testssl.sh color coding mean?

Green indicates secure, yellow indicates warning, and red indicates vulnerable. The color coding helps quickly identify security issues.

How do I check for specific CVEs with testssl.sh?

Use --vulnerable to focus on vulnerability detection, or -U for vulnerabilities only. testssl.sh checks for hundreds of known CVEs.

What is the --quiet flag in testssl.sh?

The --quiet flag reduces output noise, showing only essential information. Useful for scripting or when you want minimal output.

How do I check certificate expiration with testssl.sh?

Use testssl.sh -x target.com to check certificate expiration and chain validation.

What is testssl.sh's --server-defaults flag?

The --server-defaults flag shows the server's default cipher and protocol preferences, useful for understanding the server's security configuration.

Tags

#vulnerability-analysis#ssl-tls#crypto-flaws#comprehensive-audit

Ethical Usage Notice

This tool is designed for authorized security testing, educational purposes, and legitimate network administration only. Unauthorized access to computer systems is illegal.