It's common to apply HTTPS for web service security. The HTTPS requires proper security configuration to ensure secure communication. The common security issues can be weak cipher suites, insecure renegotiation, Heartbleed attack, invalid certificates, and insecure protocols, such as SSL v3, TLS 1.1. (TLS v1.3 is the latest secure communication protocol at the time of the writing.)
The following table lists common HTTPS security testing scenario and the uses of SSLyze:
|
HTTPS security testing scenarios |
SSLyze command options |
|
Check for Heartbleed vulnerability |
Sslyze --heartbleed |
|
Check for certificate validation |
Sslyze --certinfo=basic |
|
Check compression for CRIME attack |
Sslyze --compression |
|
Check for renegotiation issues |
Ssylze --reneg |
The SSLyze can be installed by Python PIP or there is also a Windows .exe...