• Stars
    star
    344
  • Rank 122,756 (Top 3 %)
  • Language
    Perl
  • License
    GNU General Publi...
  • Created almost 12 years ago
  • Updated about 1 year ago

Reviews

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Repository Details

O-Saft - OWASP SSL advanced forensic tool

Any use of this project's code by GitHub Copilot, past or present, is done without our permission. We do not consent to GitHub's use of this project's code in Copilot.

O-Saft - OWASP SSL advanced forensic tool

DESCRIPTION

This tools lists information about remote target's SSL certificate and tests the remote target according given list of ciphers.

UNIQUE FEATURES

  • working in closed environments, i.e. without internet connection
  • checking availability of ciphers independent of installed library
  • checking for all possible ciphers (up to 65535 per SSL protocol)
  • needs just perl without modules for checking ciphers and protocols
  • mainly same results on all platforms

WHY?

Why a new tool for checking SSL when there already exist a dozens or more good tools in 2012? Some (but not all) reasons are:

  • lack of tests of unusual ciphers
  • different results returned for the same check on same target
  • missing functionality (checks) according modern SSL/TLS
  • lack of tests of unusual (SSL, certificate) configurations
  • (mainly) missing feasability to add own tests

For more details, please use:

o-saft.pl --help

or read the source ;-)

TARGET AUDIENCE

  • penetration testers
  • administrators

INSTALLATION

o-saft.pl requires following Perl modules:

Module Version
Net::SSLeay (prefered >= 1.51, recommended 1.85)
IO::Socket::SSL (prefered >= 1.37, recommended 2.002)
IO::Socket::INET (prefered >= 2.31)
Net::DNS (prefered >= 0.65, for --mx option only)

O-Saft can be executed from within the unpacked or cloned directory, installation is not necessary. However, a INSTALL.sh script will be provided, which can be called as follows:

INSTALL.sh
INSTALL.sh --clean
INSTALL.sh --check
INSTALL.sh --n /path/to/install --force
INSTALL.sh     /path/to/install --force

There're no dependencies to other perl modules for checkAllCiphers.pl so the test of all ciphers will work with it. The modules Net::SSLinfo, Net::SSLhello are part of O-Saft and should be installed in ./Net .

Following files are optional:

File / Tool Description
.o-saft.pl (private user configuration)
o-saft-dbx.pm (for debugging, tracing)
o-saft-usr.pm (private functions, some kind of API)
o-saft-man.pm (documentation and generation functions)
o-saft.pod (documentation in POD format)
checkAllCiphers.pl (simple script for checking all ciphers)
.o-saft.tcl (private user configuration for GUI)
o-saft-img.tcl (images for buttons in GUI)
contrib/* (additional programs and tools)

QUICK START

o-saft.pl --help
o-saft.pl +check your.tld
o-saft.pl +info  your.tld
o-saft.pl +quick your.tld
o-saft.pl +cipher    your.tld
o-saft.pl --help=commands

o-saft.tcl      # (simple GUI; requires Tcl/Tk 8.5 or newer)

o-saft-docker   # (simple wrapper to call o-saft.pl in docker image)

Get a Copy (latest stable release)

wget https://github.com/OWASP/O-Saft/raw/master/o-saft.tgz

Get a Copy (development version)

git clone https://github.com/OWASP/O-Saft.git
git clone [email protected]:OWASP/O-Saft.git

Get Docker Image (latest stable release)

docker pull owasp/o-saft

VERSION

23.04.23

The version of the tarball o-saft.tgz represents the version listed on top herein. All other files in the repository may be ahead of this tarball version.

SHA256 checksum of o-saft.tgz

14d1e1b202fa07152d6f16af72b520736dac06a2ee135cdf156d94ba321a67a7

SHA256 checksum of owasp/o-saft:latest and owasp/o-saft:18.11.18

b85423d142c186c1cf10494aa0e993f6f2030ab769977aca9584d7d650421697

NOTE that the checksums listed here are the previous versions if this file is from o-saft.tgz itself, or inside the docker image.

More Repositories

1

CheatSheetSeries

The OWASP Cheat Sheet Series was created to provide a concise collection of high value information on specific application security topics.
Python
27,397
star
2

owasp-mastg

The Mobile Application Security Testing Guide (MASTG) is a comprehensive manual for mobile app security testing and reverse engineering. It describes the technical processes for verifying the controls listed in the OWASP Mobile Application Security Verification Standard (MASVS).
Python
11,668
star
3

Amass

In-depth Attack Surface Mapping and Asset Discovery
Go
7,941
star
4

wstg

The Web Security Testing Guide is a comprehensive Open Source guide to testing the security of web applications and web services.
Dockerfile
7,090
star
5

Go-SCP

Golang Secure Coding Practices guide
Go
4,788
star
6

Top10

Official OWASP Top 10 Document Repository
HTML
4,262
star
7

Nettacker

Automated Penetration Testing Framework - Open-Source Vulnerability Scanner - Vulnerability Management
Python
3,374
star
8

ASVS

Application Security Verification Standard
HTML
2,704
star
9

owasp-masvs

The OWASP MASVS (Mobile Application Security Verification Standard) is the industry standard for mobile app security.
Python
2,025
star
10

API-Security

OWASP API Security Project
Dockerfile
2,013
star
11

DevGuide

The OWASP Guide
2,011
star
12

NodeGoat

The OWASP NodeGoat project provides an environment to learn how OWASP Top 10 security risks apply to web applications developed using Node.js and how to effectively address them.
HTML
1,857
star
13

QRLJacking

QRLJacking or Quick Response Code Login Jacking is a simple-but-nasty attack vector affecting all the applications that relays on “Login with QR code” feature as a secure way to login into accounts which aims for hijacking users session by attackers.
Python
1,346
star
14

SecurityShepherd

Web and mobile application security training platform
Java
1,332
star
15

wrongsecrets

Vulnerable app with examples showing how to not use secrets
Java
1,196
star
16

www-project-top-ten

OWASP Foundation Web Respository
HTML
1,098
star
17

crAPI

completely ridiculous API (crAPI)
Java
1,090
star
18

www-community

OWASP Community Pages are a place where OWASP can accept community contributions for security-related content.
HTML
1,078
star
19

joomscan

OWASP Joomla Vulnerability Scanner Project https://www.secologist.com/
Raku
1,062
star
20

threat-dragon

An open source threat modeling tool from OWASP
JavaScript
909
star
21

railsgoat

A vulnerable version of Rails that follows the OWASP Top 10
HTML
859
star
22

java-html-sanitizer

Takes third-party HTML and produces HTML that is safe to embed in your web application. Fast and easy to configure.
Java
788
star
23

OWASP-VWAD

The OWASP Vulnerable Web Applications Directory project (VWAD) is a comprehensive and well maintained registry of all known vulnerable web applications currently available.
749
star
24

DevSecOpsGuideline

The OWASP DevSecOps Guideline can help us to embedding security as a part of the development pipeline.
Python
705
star
25

IoTGoat

IoTGoat is a deliberately insecure firmware created to educate software developers and security professionals with testing commonly found vulnerabilities in IoT devices.
C
680
star
26

ZSC

OWASP ZSC - Shellcode/Obfuscate Code Generator https://www.secologist.com/
Python
645
star
27

Docker-Security

Getting a handle on container security
Dockerfile
622
star
28

OWASP-WebScarab

OWASP WebScarab
Java
582
star
29

MASTG-Hacking-Playground

Java
574
star
30

www-project-kubernetes-top-ten

OWASP Foundation Web Respository
HTML
554
star
31

DVSA

a Damn Vulnerable Serverless Application
JavaScript
532
star
32

glue

Application Security Automation
Ruby
522
star
33

SecureCodingDojo

The Secure Coding Dojo is a platform for delivering secure coding knowledge.
PHP
521
star
34

www-project-top-10-for-large-language-model-applications

OWASP Foundation Web Respository
TeX
514
star
35

owasp-java-encoder

The OWASP Java Encoder is a Java 1.5+ simple-to-use drop-in high-performance encoder class with no dependencies and little baggage. This project will help Java web developers defend against Cross Site Scripting!
Java
477
star
36

Python-Honeypot

OWASP Honeypot, Automated Deception Framework.
Python
429
star
37

www-project-web-security-testing-guide

The Web Security Testing Guide (WSTG) Project produces the premier cybersecurity testing resource for web application developers and security professionals.
HTML
429
star
38

OFFAT

The OWASP OFFAT tool autonomously assesses your API for prevalent vulnerabilities, though full compatibility with OAS v3 is pending. The project remains a work in progress, continuously evolving towards completion.
Python
425
star
39

rbac

PHP-RBAC is an authorization library for PHP. It provides developers with NIST Level 2 Standard Role Based Access Control and more, in the fastest implementation yet.
PHP
423
star
40

owasp.github.io

OWASP Foundation main site repository
HTML
423
star
41

iGoat-Swift

OWASP iGoat (Swift) - A Damn Vulnerable Swift Application for iOS
C
398
star
42

samm

SAMM stands for Software Assurance Maturity Model.
JavaScript
395
star
43

threat-model-cookbook

This project is about creating and publishing threat model examples.
Python
373
star
44

igoat

OWASP iGoat - A Learning Tool for iOS App Pentesting and Security by Swaroop Yermalkar
C
368
star
45

Vulnerable-Web-Application

OWASP Vulnerable Web Application Project https://github.com/hummingbirdscyber
PHP
345
star
46

vbscan

OWASP VBScan is a Black Box vBulletin Vulnerability Scanner
Perl
323
star
47

Serverless-Goat

OWASP ServerlessGoat: a serverless application demonstrating common serverless security flaws
Python
312
star
48

SecureTea-Project

The OWASP SecureTea Project provides a one-stop security solution for various devices (personal computers / servers / IoT devices)
JavaScript
287
star
49

RiskAssessmentFramework

The Secure Coding Framework
TypeScript
245
star
50

D4N155

OWASP D4N155 - Intelligent and dynamic wordlist using OSINT
Shell
223
star
51

Serverless-Top-10-Project

OWASP Serverless Top 10
210
star
52

pysap

pysap is an open source Python library that provides modules for crafting and sending packets using SAP's NI, Diag, Enqueue, Router, MS, SNC, IGS, RFC and HDB protocols.
Python
205
star
53

www-project-ai-security-and-privacy-guide

OWASP Foundation Web Respository
HTML
199
star
54

www-chapter-japan

OWASP Foundation Web Respository
HTML
198
star
55

phpsec

OWASP PHP Security Project - THIS PROJECT IS INACTIVE AND MAY CONTAIN SECURITY FLAWS
197
star
56

json-sanitizer

Given JSON-like content, The JSON Sanitizer converts it to valid JSON.
Java
190
star
57

Maturity-Models

Node application to help managing Maturity Models like the ones created by BSIMM and OpenSAMM
JavaScript
184
star
58

passfault

OWASP Passfault evaluates passwords and enforces password policy in a completely different way.
JavaScript
169
star
59

ASST

OWASP ASST (Automated Software Security Toolkit) | A Novel Open Source Web Security Scanner.
JavaScript
152
star
60

Software-Component-Verification-Standard

Software Component Verification Standard (SCVS)
Python
133
star
61

IoT-Security-Verification-Standard-ISVS

OWASP IoT Security Verification Standard (ISVS)
TeX
130
star
62

owasp-summit-2017

Content for OWASP Summit 2017 site
CSS
127
star
63

BLT

OWASP BLT is a bug logging tool to report issues and get points, companies are held accountable.
HTML
124
star
64

www-project-secure-headers

The OWASP Secure Headers Project
Python
122
star
65

www-project-proactive-controls

OWASP Foundation Web Respository
Shell
122
star
66

www-project-code-review-guide

OWASP Code Review Guide Web Repository
HTML
119
star
67

SEDATED

SEDATED® Project (Sensitive Enterprise Data Analyzer To Eliminate Disclosure)
Shell
109
star
68

sonarqube

OWASP SonarQube Project
Dockerfile
109
star
69

raider

OWASP Raider: a novel framework for manipulating the HTTP processes of persistent sessions
Python
103
star
70

OWASP-Testing-Guide

OWASP Testing Guide
103
star
71

OWASPWebGoatPHP

A deliberately vulnerable web application for learning web application security.
PHP
99
star
72

user-security-stories

Repo to hold mapping of user-security-stories
99
star
73

KubeLight

OWASP Kubernetes security and compliance tool [WIP]
Python
97
star
74

www-project-mobile-top-10

HTML
83
star
75

owasp-istg

The IoT Security Testing Guide (ISTG) provides a comprehensive methodology for penetration tests in the IoT field, offering flexibility to adapt innovations, and developments in the IoT market while still ensuring comparability of test results.
Python
83
star
76

www-project-webgoat

OWASP Foundation Web Respository
HTML
81
star
77

Honeypot-Project

Python
79
star
78

NINJA-PingU

Python
77
star
79

threat-dragon-desktop

Desktop variant of OWASP Threat Dragon
77
star
80

OpenCRE

Python
77
star
81

www-project-developer-guide

OWASP Project Developer Guide - Document and Project Web pages
HTML
77
star
82

www-project-csrfguard

The aim of this project is to protect Java applications against CSRF attacks with the use of Synchronizer Tokens
Java
77
star
83

www-project-zap

OWASP Zed Attack Proxy project landing page.
HTML
72
star
84

www-project-threat-dragon

OWASP Foundation Threat Dragon Project Web Repository
HTML
70
star
85

SSO_Project

OWASP Single Sign-On allows a secure-by-default self-hosted SSO experience, including phishing-proof two-factor authentication, using state-of-the-art security mechanisms.
JavaScript
68
star
86

www-project-machine-learning-security-top-10

OWASP Machine Learning Security Top 10 Project
HTML
67
star
87

www-project-application-security-verification-standard

OWASP Foundation Web Respository
HTML
65
star
88

PHP-ESAPI

Migrated from code.google.com to a more active public repository.
PHP
65
star
89

www-project-security-knowledge-framework

OWASP Foundation Web Respository
HTML
64
star
90

wpBullet

Python
63
star
91

www-project-top-10-low-code-no-code-security-risks

OWASP Low-Code/No-Code Top 10
HTML
62
star
92

www-project-secure-coding-practices-quick-reference-guide

OWASP Foundation Project Web Repository for Secure Coding Practices Quick-reference Guide
HTML
59
star
93

www-project-top-10-ci-cd-security-risks

OWASP Foundation Web Respository
HTML
58
star
94

Container-Security-Verification-Standard

Container Security Verification Standard
Python
57
star
95

www-project-devsecops-guideline

The OWASP DevSecOps Guideline explains how we can implement a secure pipeline and use best practices and introduce tools that we can use in this matter. Also, the project is trying to help us promote the shift-left security culture in our development process.
HTML
49
star
96

www-project-devsecops-maturity-model

OWASP Foundation Web Respository
HTML
48
star
97

www-project-juice-shop

OWASP Foundation Web Respository
HTML
48
star
98

packman

A documentation and tracking project with the goal of making package management systems more secure.
48
star
99

www-project-api-security

OWASP Foundation Web Repository
HTML
47
star
100

WebGoat

This is a defunct code base. The project is located at: https://github.com/WebGoat
HTML
47
star