Various issues with testssl integration

[mgrottenthaler]

Describe the bug
At first I liked the idea of testssl integration. But then I realized that there are various problems:

• In kali testssl.sh is by default installed as testssl (without .sh). testssl.sh is hardcoded in humble. Thus I had to create a symbolic link for this functionality to work and use /usr/bin as the directory
• For me humble -u https://www.example.com -e /usr/bin only executed testssl. Humbel was not executed. I think there is a bug.

I think both tools should be kept separately. Better write a wrapper script which executes both

To Reproduce
Steps to reproduce the behavior:

In Kali

sudo apt install humble testssl.sh
humble -u https://www.example.com -e /usr/bin
# error
sudo ln -s /usr/bin/testssl /usr/bin/testssl.sh
humble -u https://www.example.com -e /usr/bin
# now it works

[rfc-st]

Hello, @mgrottenthaler

Thank you for this issue. On the first point, indeed, the literal 'testssl.sh' is hardcoded in humble.py. When I made this feature I tested it only by cloning the testssl.sh repository, and not with the version that Kali provides. This weekend I will adapt that code and logic it to not assume that testssl always runs as 'testssl.sh'; or directly find the file, in the path provided by the user, that launches these TLS/SSL tests.

On the second point, that is the default behavior of the '-e' parameter in 'humble': it also requires the '-u' parameter to tell testssl which URL to analyze. I hadn't thought that it might also be useful to run the analysis with 'humble' together with testssl ... I'll take a look about it.

I'll let you know in this issue when I fix the first point.

Thanks!.

Best regards,

[mgrottenthaler]

My assumption was that humble integrates the results from testssl in the final report. But I am not sure if this makes much sense.

Of course it's up to you, but I would stick to the principle of one tool, one purpose. I would rather just write another tool that is a wrapper around humble and testssl and possibly other tools

[rfc-st]

Hi, @mgrottenthaler

Rearding your assumption, yes, I think it would be helpful if I modified the text of the '-e' parameter to indicate this (I highlight the added text):

'-e [TESTSSL_PATH] Displays only TLS/SSL checks; requires the PATH from https://testssl.sh/'

Regards,

[rfc-st]

Hi, @mgrottenthaler

Please, take a look at 7591162:

• Improved description of the '-e' parameter: noting that only TLS/SSL checks will be executed when using it.
• Before running the TLS/SSL tests, a check is added to see if 'testssl' or 'testssl.sh' exists in the specified path.

I hope that with these changes no more symbolic links will be necessary! :). I would appreciate if you could test this commit, in order to solve this issue (naming you, of course, in the acknowledgements section).

Have a nice weekend!.

Best regards,

[rfc-st]

Hi, @mgrottenthaler

After these few days I understand that several of your initial comments have been resolved. I close this issue.

Regards,

[mgrottenthaler]

Hi @rfc-st

I am very sorry, yes this resolves the issue I can now just execute it like this python3 humble.py -e /usr/bin/ -u example.com