Added info about OpenSSL proxy option to cipherscan script. #131
Conversation
| @@ -250,6 +250,8 @@ Some useful OpenSSL options: | |||
| that require turning TLS after initial protocol specific | |||
| hello | |||
| -servername name Request SNI support for connections | |||
| -proxy proxyhost:port Connect to the scan target via specified proxy | |||
| (req. OpenSSL 1.0.x) | |||
There was a problem hiding this comment.
does it really work in all 1.0.x branches? I don't see it listed in 1.0.2j s_client -help message....
There was a problem hiding this comment.
Hmmm, this is interesting. The copy of OpenSSL supplied with cipherscan works with the -proxy option, but a local copy of 1.0.2j doesn't work with it. May have to change that to something like "Requires supplied OpenSSL or >1.1.0"? Trying to figure out exactly where this got introduced to OpenSSL is a challenge because the feature appears to predate their migration to Git (at least, I couldn't find anything about it in their repository).
|
It's in 1.1.0 but not 1.0.2.
https://rt.openssl.org/m/ticket/show?id=2651
May be of use if you want to scan a bunch of tags for it.
…On Fri, Dec 2, 2016 at 14:11 castillar ***@***.***> wrote:
***@***.**** commented on this pull request.
------------------------------
In cipherscan <#131>:
> @@ -250,6 +250,8 @@ Some useful OpenSSL options:
that require turning TLS after initial protocol specific
hello
-servername name Request SNI support for connections
+-proxy proxyhost:port Connect to the scan target via specified proxy
+ (req. OpenSSL 1.0.x)
Hmmm, this is interesting. The copy of OpenSSL supplied with cipherscan
works with the -proxy option, but a local copy of 1.0.2j doesn't work with
it. May have to change that to something like "Requires supplied OpenSSL or
>1.1.0"? Trying to figure out exactly where this got introduced to OpenSSL
is a challenge because the feature appears to predate their migration to
Git (at least, I couldn't find anything about it in their repository).
—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub
<#131>, or mute the thread
<https://github.com/notifications/unsubscribe-auth/AAFqDB8LmkAEUQOTD944hdiXXCa2dYQUks5rEJeYgaJpZM4LCzKt>
.
|
|
Fixed! Modified the version message to specify 1.1.0 or bundled OpenSSL. Thanks to @floatingatoll for the pointer--that'll come in handy! |
Per issue #129.