tlsfuzzer | SSL and TLS protocol test suite and fuzzer | TLS library

by tlsfuzzer Python Version: Current License: GPL-2.0

X-Ray Key Features Code Snippets Community Discussions(1)Vulnerabilities Install Support

kandi X-RAY | tlsfuzzer Summary

tlsfuzzer is a Python library typically used in Security, TLS applications. tlsfuzzer has no bugs, it has no vulnerabilities, it has build file available, it has a Strong Copyleft License and it has low support. You can download it from GitHub.

tlsfuzzer is a test suite for SSLv2, SSLv3, TLS 1.0, TLS 1.1, TLS 1.2, and TLS 1.3 implementations. It's in early stages of development, so there are no API stability guarantees. While it uses fuzzing techniques for testing (randomisation of passed in inputs), the scripts are generally written in a way that verifies correct error handling: unlike typical fuzzers it doesn't check only that the system under test didn't crash, it checks that it returned correct error messages. You can find ready-to-use scripts testing for many vulnerabilities ( ROBOT, DROWN, etc.) and general standards conformity (RFC 5246, RFC 7627, RFC 7905, etc.) in the scripts/ directory.

Support

Quality

Security

License

Reuse

Support

tlsfuzzer has a low active ecosystem.

It has 473 star(s) with 103 fork(s). There are 38 watchers for this library.

It had no major release in the last 6 months.

There are 248 open issues and 123 have been closed. On average issues are closed in 323 days. There are 11 open pull requests and 0 closed requests.

It has a neutral sentiment in the developer community.

The latest version of tlsfuzzer is current.

Quality

tlsfuzzer has no bugs reported.

Security

tlsfuzzer has no vulnerabilities reported, and its dependent libraries have no vulnerabilities reported.

License

tlsfuzzer is licensed under the GPL-2.0 License. This license is Strong Copyleft.

Strong Copyleft licenses enforce sharing, and you can use them when creating open source projects.

Reuse

tlsfuzzer releases are not available. You will need to build from source code and install.

Build file is available. You can build the component from source.

Installation instructions are not available. Examples and code snippets are available.

Top functions reviewed by kandi - BETA

kandi has reviewed tlsfuzzer and discovered the below as its top functions. This is intended to give you an instant insight into tlsfuzzer implemented functionality, and help decide if they suit your requirements.

Fuzz the padding function
Restore a method from msg_sock
Substitute and xor
Divide a divident
Main loop
Get all siblings
Guess the response for the given content type
Run the test suite
Get the list of classes
Combine the input files
Generate a random structure
Check uniqueness of values
Generate test log
Report progress
Generate a PreSharedKeyExtension
Parse expected extensions
Fuzz MAC
Pad a handshake
Handles PRE - shared key
Fuzz a generator
Fuzz the encrypted message
Set the record size limit
Fuzz a message
Merge two dicts
Split a message into multiple fragments
Convert a signature name to a list of ids

Get all kandi verified functions for this library.

tlsfuzzer Key Features

No Key Features are available at this moment for tlsfuzzer.

tlsfuzzer Examples and Code Snippets

No Code Snippets are available at this moment for tlsfuzzer.

Community Discussions

Trending Discussions on tlsfuzzer

Invalid JWT signature with ES256

QUESTION

Invalid JWT signature with ES256

Asked 2021-Feb-25 at 15:47

I'm trying to manually create an ES256 JWT token. I've a small script written in python which signs a sha256 hash which uses ecdsa-python. But the signature is invalid on jwt.io.

Steps to reproduce:

Create base64 header + payload:

eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiYWRtaW4iOnRydWUsImlhdCI6MTUxNjIzOTAyMn0

Create SHA256 hash from the base64 header + payload:

FFC89E33091FFDD3C61798A0A74BF7C2D1A6FD231A6CB519F33952F7696BBE9F

Generate ec_private key:

openssl ec -in ec_private.pem -noout -text

Use the small python program to ecdsa sign the SHA256 hash

...

ANSWER

Answered 2021-Feb-25 at 15:47

The library you are using hashes implicitly, applying SHA1 by default. I.e. for compatibility with ES256 SHA256 must be explicitly specified and the unhashed JWT must be used, e.g.:

Source https://stackoverflow.com/questions/66349140

Community Discussions, Code Snippets contain sources that include Stack Exchange Network

Vulnerabilities

No vulnerabilities reported

Install tlsfuzzer

You can download it from GitHub.
You can use tlsfuzzer like any standard Python library. You will need to make sure that you have a development environment consisting of a Python distribution including header files, a compiler, pip, and git installed. Make sure that your pip, setuptools, and wheel are up to date. When using pip it is generally recommended to install packages in a virtual environment to avoid changes to the system.

Support

See the CONTRIBUTING.md document for description how to set up your development environment, sanity check the changes and requirements the changes need to follow. You may also want to read the VISION.md to learn more about the planned scope of the project. Contributors are expected to follow the project's CODE OF CONDUCT when interacting with other members of the community.

Find more information at: