Documentation
¶
Index ¶
Constants ¶
View Source
const ( ModuleID = "tls-protocol-cipher-audit" ModuleName = "TLS Protocol & Cipher Audit" ModuleShort = "Grades a host's TLS by negotiating deprecated protocols and weak cipher suites directly" )
Variables ¶
View Source
var ( ModuleDesc = `` /* 610-byte string literal not displayed */ ModuleConfirmation = "" /* 188-byte string literal not displayed */ ModuleSeverity = severity.Low ModuleConfidence = severity.Certain ModuleTags = []string{"tls", "crypto", "transport", "misconfiguration", "hygiene", "moderate"} )
Functions ¶
This section is empty.
Types ¶
type Module ¶
type Module struct {
modkit.BaseActiveModule
// contains filtered or unexported fields
}
Module implements the TLS Protocol & Cipher Audit active scanner.
func (*Module) CanProcess ¶
func (m *Module) CanProcess(ctx *httpmsg.HttpRequestResponse) bool
CanProcess accepts any request carrying a resolvable service; the HTTPS/TLS gate is applied once per host inside ScanPerHost.
func (*Module) IncludesBaseCanProcess ¶
IncludesBaseCanProcess returns false because this module uses a custom CanProcess.
func (*Module) ScanPerHost ¶
func (m *Module) ScanPerHost( ctx *httpmsg.HttpRequestResponse, _ *http.Requester, scanCtx *modkit.ScanContext, ) ([]*output.ResultEvent, error)
ScanPerHost audits the host's TLS configuration. It first confirms the host actually speaks TLS (a baseline handshake) — the technology gate — then probes each weak protocol/cipher setting, re-confirming every hit with a second handshake before reporting. A host that only supports TLS 1.2+/forward-secret AEAD suites yields no finding.
Source Files
Click to show internal directories.
Click to hide internal directories.