Adblock Detected

Read

Sslmerge - Tool To Help You Build A Valid SSL Certificate Chain From The Root Certificate To The End-User Certificate

Read

Is an open source tool to help you build a valid SSL certificate chain from the root certificate to the end-user certificate. Also can help you fix the incomplete certificate chain and download all missing CA certificates.

How To Use
It's simple:

# Clone this repository
git clone https://github.com/trimstray/sslmerge

# Go into the repository
cd sslmerge

# Install
./setup.sh install

# Run the app
sslmerge -i /data/certs -o /data/certs/chain.crt

symlink to bin/sslmerge is placed in /usr/local/bin
man page is placed in /usr/local/man/man8

Parameters
Provides the following options:

  Usage:
    sslmerge 

  Examples:
    sslmerge --in Root.crt --in Intermediate1.crt --in Server.crt --out bundle_chain_certs.crt
    sslmerge --in /tmp/certs --out bundle_chain_certs.crt --with-root
    sslmerge -i Server.crt -o bundle_chain_certs.crt

  Options:
        --help        show this message
        --debug       displays information on the screen (debug mode)
    -i, --in          add certificates to merge (certificate file, multiple files or directory with ssl certificates)
    -o, --out         saves the result (chain) to file
        --with-root   add root certificate to the certificate chain

How it works
Let's start with ssllabs certificate chain. They are delivered together with the sslmerge and can be found in the example/ssllabs.com directory which additionally contains the all directory (containing all the certificates needed to assemble the chain) and the server_certificate directory (containing only the server certificate).
The correct chain for the ssllabs.com domain (the result of the openssl command):

Certificate chain
 0 s:/C=US/ST=California/L=Redwood City/O=Qualys, Inc./CN=ssllabs.com
   i:/C=US/O=Entrust, Inc./OU=See www.entrust.net/legal-terms/OU=(c) 2012 Entrust, Inc. - for authorized use only/CN=Entrust Certification Authority - L1K
 1 s:/C=US/O=Entrust, Inc./OU=See www.entrust.net/legal-terms/OU=(c) 2012 Entrust, Inc. - for authorized use only/CN=Entrust Certification Authority - L1K
   i:/C=US/O=Entrust, Inc./OU=See www.entrust.net/legal-terms/OU=(c) 2009 Entrust, Inc. - for authorized use only/CN=Entrust Root Certification Authority - G2
 2 s:/C=US/O=Entrust, Inc./OU=See www.entrust.net/legal-terms/OU=(c) 2009 Entrust, Inc. - for authorized use only/CN=Entrust Root Certification Authority - G2
   i:/C=US/O=Entrust, Inc./OU=www.entrust.net/CPS is incorporated by reference/OU=(c) 2006 Entrust, Inc./CN=Entrust Root Certification Authority

The above code presents a full chain consisting of:

Identity Certificate (Server Certificate)
issued for ssllabs.com by Entrust Certification Authority - L1K
Intermediate Certificate
issued for Entrust Certification Authority - L1K by Entrust Root Certification Authority - G2
Intermediate Certificate
issued for Entrust Root Certification Authority - G2 by Entrust Root Certification Authority
Root Certificate (Self-Signed Certificate)
issued for Entrust Root Certification Authority by Entrust Root Certification Authority

Scenario 1
In this scenario, we will chain all delivered certificates. Example of running the tool:

Scenario 2
In this scenario, we only use the server certificate and use it to retrieve the remaining required certificates. Then, as above, we will combine all the provided certificates. Example of running the tool:

Certificate chain
In order to create a valid chain, you must provide the tool with all the necessary certificates. It will be:

Server Certificate
Intermediate CAs and Root CAs

This is very important because without it you will not be able to determine the beginning and end of the chain.
However, if you look inside the generated chain after generating with sslmerge, you will not find the root certificate there. Why?
Because self-signed root certificates need not/should not be included in web server configuration. They serve no purpose (clients will always ignore them) and they incur a slight performance (latency) penalty because they increase the size of the SSL handshake.
If you want to add a root certificate to the certificate chain, call the utility with the --with-root parameter.

Certification Paths
Sslmerge allows use of two certification paths:

Output comments
When generating the chain of certificates, sslmerge displays comments with information about certificates, including any errors.
Here is a list of all possibilities:

not found identity (end-user, server) certificate
The message is displayed in the absence of a server certificate that is the beginning of the chain. This is a unique case because in this situation the sslmerge ends its operation displaying only this information. The server certificate is the only certificate required to correctly create a chain. Without this certificate, the correct chain will not be created.

found correct identity (end-user, server) certificate
The reverse situation here - message displayed when a valid server certificate is found.

not found first intermediate certificate
This message appears when the first of the two intermediate certificates is not found. This information does not explicitly specify the absence of a second intermediate certificate and on the other hand it allows to determine whether the intermediate certificate to which the server certificate was signed exists. Additionally, it can be displayed if the second intermediate certificate has been delivered.

not found second intermediate certificate
Similar to the above, however, it concerns the second intermediate certificate. However, it is possible to create the chain correctly using the second certification path, e.g. using the first intermediate certificate and replacing the second with the main certificate.

one or more intermediate certificate not found
This message means that one or all of the required intermediate certificates are missing and displayed in the absence of the root certificate.

found 'n' correct intermediate certificate(s)
This message indicates the number of valid intermediate certificates.

not found correct root certificate
The lack of the root certificate is treated as a warning. Of course, when configuring certificates on the server side, it is not recommended to attach a root certificate, but if you create it with the sslmerge, it treats the chain as incomplete displaying information about the incorrect creation of the chain.

an empty CN field was found in one of the certificates
This message does not inform about the error and about the lack of the CN field what can happen with some certificates (look at example/google.com). Common Name field identifies the host name associated with the certificate. There is no requirement in RFC3280 for an Issuer DN to have a CN. Most CAs do include a CN in the Issuer DN, but some don't, such as this Equifax CA.

Requirements
Sslmerge uses external utilities to be installed before running:

openssl

Other

Contributing
See this.

Project architecture
See this.

Download Sslmerge

FakeNet - Windows Network Simulation tool for Malware Analysis

Read

FakeNet is a tool that aids in the dynamic analysis of malicious software. The tool simulates a network so that malware interacting with a remote host continues to run allowing the analyst to observe the malware’s network activity from within a safe environment. The goal of the project is to:

Be easy to install and use; the tool runs on Windows and requires no 3rd party libraries
Support the most common protocols used by malware
Perform all activity on the local machine to avoid the need for a second virtual machine
Provide python extensions for adding new or custom protocols
Keep the malware running so that you can observe as much of its functionality as possible
Have a flexible configuration, but no required configuration

The tool is in its infancy of development. We started working on the tool in January 2012 and we intend to maintain the tool and add new and useful features. If you find a bug or have a cool feature you think would improve the tool please contact us.

Features

Supports DNS, HTTP, and SSL
HTTP server always serves a file and tries to serve a meaningful file; if the malware request a .jpg then a properly formatted .jpg is served, etc. The files being served are user configurable.
Ability to redirect all traffic to the localhost, including traffic destined for a hard-coded IP address.
Python extensions, including a sample extension that implements SMTP and SMTP over SSL.
Built in ability to create a capture file (.pcap) for packets on localhost.
Dummy listener that will listen for traffic on any port, auto-detect and decrypt SSL traffic and display the content to the console.

Demo Video

Click here to watch a demo of version 0.9 of the tool in action.

How it works

FakeNet uses a variety of Windows and third party libraries. It uses a custom HTTP and DNS server to respond to those request. It uses OpenSSL to wrap any connection with SSL. It uses a Winsock Layered Service Provider (LSP) to redirect traffic to the localhost and to listen for traffic on new ports. It uses python 2.7 for the python extensions. And, it creates the .pcap file by reconstructing a packet header based on the traffic from send/recv calls.

Download FakeNet

Collection of Heartbleed Tools (OpenSSL CVE-2014-0160)

Read

[SSLSmart] Smart SSL Cipher Enumeration

Read

[SSL Audit] Remotely scans web servers for SSL support

Read

[SSLDigger v1.02] Tool to assess the strength of SSL

Read

[Harden SSL/TLS] Hardening the SSL/TLS settings

Read

[sslnuke] SSL without verification isn't secure!

Read

[HoneyProxy] A man-in-the-middle SSL Proxy & Traffic Analyzer

Read

HoneyProxy is a lightweight tool that allows live HTTP(S) traffic inspection and analysis.

It focuses on features that are useful for malware analysis and network forensics.

Features

Analyze HTTP(S) traffic on the fly
Filter and highlight traffic, regex support included.
Report Generation for saved flows, including a live JS editor.
Save HTTP conversations for later analysis
Make scripted changes with Python, e.g. remove Cache Header.
based on and compatible to mitmproxy.
cross-platform (Windows, OSX and Linux)
SSL interception certs generated on the fly

Looking for more? Check out our GitHub wiki!

Quick Start

Download the latest release or pick a development snapshot.

Install all dependencies: pip install pyOpenSSL pyasn1 Twisted Autobahn
Windows users: Install the binaries for pyOpenSSL and Twisted manually (or compile yourself).
Ubuntu / Debian users: Install twisted as a package (sudo apt-get install python-twisted). If you get errors, check this page.

Start HoneyProxy with python honeyproxy.py or python honeyproxy.py --help.
If you don't use a modern browser, a kitten will die. We support both Firefox and Chrome!
Most command line parameters are documented in the mitmproxy docs.