iiinova — where your digital self keeps evolving

testssl.sh :verified: @testssl.infosec.exchange.ap.brid.gy · 25/10/2026

www.heise.de/en/news/GoDaddy-revoke… > Because they don’t match their documentation, #GoDaddy must revoke 404,607 #certificates, including those used by companies such as Host Europe and DomainFactory.

Just a teaser with https:// in the location bar

002 2

Reposted by testssl.sh :verified:

Marcel Waldvogel @marcel.waldvogel.family.ap.brid.gy · 24/10/2026

And of course you know that one! #eMudhra

The golden rating meme, showing the valuw of 4, between "-----BEGIN/END RSA PRIVATE KEY-----" lines

102 2

testssl.sh :verified: @testssl.infosec.exchange.ap.brid.gy · 29/09/2026

The development of testssl,.sh is not a full time job but it is faster than the updates here. Thus: heads up now! * both branches got an update of the docker base images (Dirk) * both branches got some fixes shellcheck pointed out (David) AND David found manually some issues * both branches' CA […]

infosec.exchange

Original post on infosec.exchange

000 0

testssl.sh :verified: @testssl.infosec.exchange.ap.brid.gy · 12/07/2026

Attention: There was a #XSS #vulnerability in testssl.sh . XSS payloads can end up unfiltered in the HTML output file of testssl.sh . Affected is the Location HTTP header where outputs were not sanitized properly. It is advised to upgrade 3.2 and 3.3dev from github. For the first, expect a bug […]

infosec.exchange

Original post on infosec.exchange

100 1

testssl.sh :verified: @testssl.infosec.exchange.ap.brid.gy · 22/06/2026

New feature coming in: DNS HTTP Resource Record in testssl.sh 3.3dev PR github.com/testssl/testssl.sh/pull/… will be merged by tomorrow. The dig command from MacOS delivers not the records in clear text but a byte stream. That made it necessary […] [Original post on infosec.exchange]

DNS HTTPS RR (expt.): yes: 1 . alpn="h3,h2" ipv4hint=104.21.34.154,172.67.205.231
ech=AEX+DQBBRAAgACBmZ5hm4SBIISaPEuHBb16If3PdpXonXf6lc+JEmDSxbgAEAAEAAQASY2xvdWRmbGFyZS1lY2guY29tAAA=
ipv6hint=2606:4700:3032::6815:229a,2606:4700:3033::ac43:cde7
Service detected: HTTP

Testing protocols via sockets except NPN+ALPN

SSLv2 not offered (OK)
SSLv3 not offered (OK)
TLS 1 not offered
TLS 1.1 not offered
TLS 1.2 offered (OK)
TLS 1.3 offered (OK): final
QUIC offered (OK): QUICv1 (h3), as advertised in DNS HTTPS RR
NPN/SPDY h2, http/1.1 (advertised)
ALPN/HTTP2 h2, http/1.1 (offered)

000 0

testssl.sh :verified: @testssl.infosec.exchange.ap.brid.gy · 20/06/2026

Thanks to potato-20 who revived an old PR from tosticated , testssl.sh 3.3dev now also has a check against the HSTS preload list -- when "--phone-out" is supplied.

000 0

Reposted by testssl.sh :verified:

Jan Schaumann @jschauma.mstdn.social.ap.brid.gy · 09/06/2026

New OpenSSL advisory: openssl-library.org/news/secadv/202… 1 high, 5 medium, 12 low severity The high (CVE-2026-45447) was explicitly noted as discovered with help from Claude. What's more interesting is again the confirmation that vulnerabilities are increasingly identified […]

mstdn.social

Original post on mstdn.social

001 1

testssl.sh :verified: @testssl.infosec.exchange.ap.brid.gy · 29/05/2026

Two smaller updates to testssl.sh (3.3dev) this week: - for client simulation forward secrecy info added to file output - warning for deprecated and other command line options end up in file output - scanning IP addresses and not host names result in a warning (exempt are some "usual suspects") […]

infosec.exchange

Original post on infosec.exchange

001 1

Reposted by testssl.sh :verified:

OWASP Germany Chapter :verified: @owasp-de.infosec.exchange.ap.brid.gy · 29/05/2026

Hallo AppSec-Community, eine kleine Erinnerung. Der Call for Presentations für den diesjährigen German #OWASP Day hat bereits die Halbzeit überschritten. Wer also vorne auf der Bühne mitspielen möchte, sollte die Deadline nicht verpassen und Gelegenheit nutzen, seinen Vortragsvorschlag dem […]

infosec.exchange

Original post on infosec.exchange

001 1

testssl.sh :verified: @testssl.infosec.exchange.ap.brid.gy · 18/05/2026

The will be a bigger update on the client simulation soon - Apple's OS 26.x finally support one #KEM (X25519MLKEM768) - #OpenSSL >=4.0.0 comes with new curves, some #SM2 related. And with a whopping 27 signature algorithms #PQC

100 1

testssl.sh :verified: @testssl.infosec.exchange.ap.brid.gy · 15/04/2026

#OpenSSL 4.0 has been released! And the busy bee dcooper16 made some adjustments to #testssl.sh - syntax when using OpenSSL 4.0 with testssl.sh. And features like curveSM2 and curveSM2MLKEM768 . github.com/openssl/openssl/blob/ope…

001 1

testssl.sh :verified: @testssl.infosec.exchange.ap.brid.gy · 09/04/2026

TL;DR: #OpenSSH has since version 9.0 PQC kx enabled. Use it! You might want to check the key exchange algos for SSH, if you had hardened them on the client or server side like years back if you don't want your ssh sessions be vulnerable to "store now, decrypt later" attacks . Only newer […]

infosec.exchange

Original post on infosec.exchange

000 0

testssl.sh :verified: @testssl.infosec.exchange.ap.brid.gy · 01/04/2026

Feisty Ducks Newsletter sheds some light onto Merkle Tree Certificates and their complexity. Also there's some little background information about why Google recently scared us wrt quantum computer break through […]

infosec.exchange

Original post on infosec.exchange

000 0

testssl.sh :verified: @testssl.infosec.exchange.ap.brid.gy · 12/02/2026

Smal version bump: 3.2.3 for the old branch of testssl.sh was just released github.com/testssl/testssl.sh/relea… Get it while it's hot ;-)

000 0

testssl.sh :verified: @testssl.infosec.exchange.ap.brid.gy · 13/11/2025

testssl.sh 3.3dev update: - shellcheck ensures better code quality when check in, thanks to MFTabriz - flag --rating only does the bare minimum of checks for SSLlabs rating, thanks to magnuslarsen Both branches had some CA stores update

000 0

testssl.sh :verified: @testssl.infosec.exchange.ap.brid.gy · 09/10/2025

testssl.sh 3.3dev now has (finally) early data support a.k.a 0-RTT .

001 1

testssl.sh :verified: @testssl.infosec.exchange.ap.brid.gy · 08/10/2025

Btw: the new server for testssl.sh also supports #QUIC and other nice smaller bells and whistles

000 0

Reposted by testssl.sh :verified:

testssl.sh :verified: @testssl.infosec.exchange.ap.brid.gy · 01/10/2025

Willing to help? See github.com/testssl/testssl.sh/issue… I am curious whether Apple finally made a step toward #PQC to catch up with all other major browser vendors with the release of version 26 of their operating systems. They lag behind since months: #TLS

Handshake simulation of testssl.sh which shows that all major browsers have sent a so called hybrid KEM (X25519MLKEM768) during the TLS ClientHello

001 1

testssl.sh :verified: @testssl.infosec.exchange.ap.brid.gy · 01/10/2025

001 1

testssl.sh :verified: @testssl.infosec.exchange.ap.brid.gy · 01/08/2025

Don't know whether anybody of you guys uses #Apple Mail but I'd rather be careful: www.linkedin.com/feed/update/urn:li… TL;DR: UI prefers #STARTTLS over #TLS for #IMAP (but actually for some reason uses both ports). Apple Product Security doesn't see a […]

infosec.exchange

Original post on infosec.exchange

000 0

testssl.sh :verified: @testssl.infosec.exchange.ap.brid.gy · 31/07/2025

testssl.sh 3.3dev got a bit snappier, most notably for Macs: #TLS #SSL #pentesting

Pic shows a protocol scan of testssl.net taking 8 seconds

Pic shows a protocol scan of testssl.net taking 13 seconds

000 0

testssl.sh :verified: @testssl.infosec.exchange.ap.brid.gy · 16/07/2025

If you didn't know: #IPv6 works for testssl.sh since an eternity. For historical reasons it needs to be enabled via "-6" on the command line or "HAS_IPv6=true" in your environment. The leftover / historical reason is an large error message when users don't have a fully working connectivity […]

infosec.exchange

Original post on infosec.exchange

100 1

testssl.sh :verified: @testssl.infosec.exchange.ap.brid.gy · 16/07/2025

testssl.sh makes it easier now for also for MacOS users to run a #QUIC protocol test -- if you have #openssl from e.g. #homebrew installed. It automagically uses that one for testing QUIC then, in 3.3dev.

000 0

testssl.sh :verified: @testssl.infosec.exchange.ap.brid.gy · 10/07/2025

For all folks who are into rating to see how good the TLS setup is: testssl.sh re-adjusted/bumped in stable (3.2) and 3.3dev the #SSLlabs rating guide to 2009r --thanks to magnuslarsen 👍

000 0

testssl.sh :verified: @testssl.infosec.exchange.ap.brid.gy · 03/07/2025

First draft for #QUIC test is there as a PR for 3.3dev

Pic shows a scan where a QUIC row appears below TLS 1.3

This shows a pic in which QUIC seems not supported by OpenSSL

100 1

testssl.sh :verified: @testssl.infosec.exchange.ap.brid.gy · 20/05/2025

Branch 3.2 has now also a github action running under MacOS which permits dealing with compatibility issue in the very beginning, i.e. when write a PR And it has more badges now ;-) -- including the status of the Ubuntu and MacOS CI runner.

Badges in the Readme @ github, including the Github runners for Ubuntu and MacOS

001 1

testssl.sh :verified: @testssl.infosec.exchange.ap.brid.gy · 08/05/2025

Can someone assist writing a unit test for #github using a MacOS runner? github.com/testssl/testssl.sh/issue… RTs welcome

Looks like the MacOS 14 runner is free: https://github.com/orgs/community/discussions/102846 for public repos.

Can somebody test a github runner for this repo?

Currently our Ubuntu runner with perl is here: https://github.com/testssl/testssl.sh/blob/3.2/.github/workflows/unit_tests.yml . Just one check with testssl.sh would suffice. It doesn't have to be perl. Anything which works is fine.

000 0

testssl.sh :verified: @testssl.infosec.exchange.ap.brid.gy · 10/04/2025

Some browsers and also #OPenSSL 3.5.0 support already #PQ #KEMs for key exchange to to provide secure key establishment resistance. The (real soon now) to be released testssl.sh 3.2 final will include handshake simulation, see last column:

201 2

testssl.sh :verified: @testssl.infosec.exchange.ap.brid.gy · 08/04/2025

#OpenSSL 3.5.0 LTS release with some #PQC algorithms, server side #QUIC support and more

100 1

testssl.sh :verified: @testssl.infosec.exchange.ap.brid.gy · 28/03/2025

Ok, the final tuning to the supplied #openssl binary has taken place. Recent patches see github.com/testssl/openssl-1.0.2.ba… Private testing went good so far. Help testing would be much appreciated. You can grab the binary from here […]

infosec.exchange

Original post on infosec.exchange

000 0

testssl.sh :verified: @testssl.infosec.exchange.ap.brid.gy · 13/03/2025

A few recent updates to testssl.sh 3.2rc4: * Improved compatibility with > OpenSSL 3.5 (David) * Check now for 6 instead of 3 KEMs (David) * Sort TLS extensions (David) * added some server side TLS extensions (Dirk) * Banner changed (Dirk) * faster startup (Dirk) * make curve checks more […]

infosec.exchange

Original post on infosec.exchange

001 1

testssl.sh :verified: @testssl.infosec.exchange.ap.brid.gy · 12/03/2025

One of Google's intermediate CAs expired on March 9, fortunately this seems for chromecast devices only: www.reddit.com/r/Chromecast/comment…

000 0