kyhau / ssllabs-scan Goto Github PK

View Code? Open in Web Editor NEW

27.0 5.0 12.0 494 KB

A simple Python script that calls SSL Labs API to do SSL testings on servers and create a report in html.

Home Page: https://kyhau.github.io/ssllabs-scan/

License: MIT License

Python 95.96% CSS 2.99% Dockerfile 1.06%

ssllabs-scan ssllabs hacktoberfest

ssllabs-scan's Introduction

SSL Labs Scan

This tool calls the SSL Labs API to do SSL testings on the given hosts, and generates csv and html reports.

The tool uses API v4 if you provide your registered email with Qualys SSLLabs via the --email argument.
The tool uses API v3 if you do not specify the --email argument. Note that v3 will be being deprecated in 2024 by Qualys.

All notable changes to this project will be documented in CHANGELOG.

Built with

Python - support Python 3.9, 3.10, 3.11, 3.12.
CodeQL is enabled in this repository.
Dependabot is enabled for auto dependency updates.
Gitleaks and TruffleHog are enabled in this GitHub Actions workflow for detecting and preventing hardcoded secrets.

Input and outputs

Sample input: sample/SampleServerList.txt

summary.html (sample output: sample/summary.html)
summary.csv (sample output: sample/summary.csv)
hostname.json (sample output: sample/google.com.json)

Sample html output:

You can change the report template and styles in these files:

Important Notes

ℹ️ Please note that from Qualys SSLLabs API v4, you must use a one-time registration with Qualys SSLLabs. For details see Introduction of API v4 for Qualys SSLLabs and deprecation of API v3.

The API v3 API will be available until the end of 2023 (Dec 31st 2023), and starting from 1st January 2024, we will be deprecating the API v3 support for SSL Labs. Request all customers to move to API v4.

ℹ️ Please note that the SSL Labs Assessment API has access rate limits. You can find more details in the sections "Error Response Status Codes" and "Access Rate and Rate Limiting" in the official SSL Labs API Documentation. Some common status codes are:

400 - invocation error (e.g., invalid parameters)
429 - client request rate too high or too many new assessments too fast
500 - internal error
503 - the service is not available (e.g., down for maintenance)
529 - the service is overloaded

Build and run

Linux

# Create and activate a new virtual env (optional)
virtualenv env
. env/bin/activate

# Install
pip install -e .

# Run with v3 (v3, which does not required a registered email, will be being deprecated in 2024)
ssllabs-scan sample/SampleServerList.txt

# Run with v4
ssllabs-scan sample/SampleServerList.txt --email <your registered email with Qualys SSLLabs>

Windows

# Create and activate a new virtual env (optional)
virtualenv env
env\Scripts\activate

# Install
pip install -e .

# Run with v3 (v3, which does not required a registered email, will be being deprecated in 2024)
ssllabs-scan sample\SampleServerList.txt

# Run with v4
ssllabs-scan sample\SampleServerList.txt --email <your registered email with Qualys SSLLabs>

Docker

# Build docker image
docker build . --tag=ssllabsscan

Running Docker from commandline:

# create directory for input and output
mkdir out
# put serverlist in directory
cp SampleServerlist.txt out
# Run docker image with created directory mounted as /tmp
# use -t option to prevent output buffering
docker run --mount type=bind,source=./out,target=/tmp ssllabsscan  -o /tmp/output.html -s /tmp/output.csv /tmp/SampleServerList.txt
# all html, csv, json output is in the out directory

Example console output

$ ssllabs-scan sample/SampleServerList.txt
Start analyzing duckduckgo.com...
Status: DNS, StatusMsg(Resolving domain names): waiting 30 secs until next check...
Status: IN_PROGRESS, StatusMsg(None): waiting 30 secs until next check...
Status: IN_PROGRESS, StatusMsg(None): waiting 30 secs until next check...
Start analyzing google.com...
Status: DNS, StatusMsg(Resolving domain names): waiting 30 secs until next check...
Status: IN_PROGRESS, StatusMsg(None): waiting 30 secs until next check...
Status: IN_PROGRESS, StatusMsg(None): waiting 30 secs until next check...
Status: IN_PROGRESS, StatusMsg(None): waiting 30 secs until next check...
Status: IN_PROGRESS, StatusMsg(None): waiting 30 secs until next check...
Status: IN_PROGRESS, StatusMsg(None): waiting 30 secs until next check...
Status: IN_PROGRESS, StatusMsg(None): waiting 30 secs until next check...
Creating summary.html ...

Run Tox tests and build the wheels

pip install -r requirements-build.txt
tox -r

ssllabs-scan's People

Stargazers

Watchers

Forkers

chefren wegerhoff alecakin alexbourg clondon sitedata gomesjj stanfrbd testssllabs aleksandarristic reinoud gadotti

ssllabs-scan's Issues

Retry only for error codes 429 and 529

Proposed changes

Existing approach retries calling the SSL Labs API for a given host when the returned status_code is not 200.

Propose to change the retry only for error codes

429 - client request rate too high or too many new assessments too fast
529 - the service is overloaded

See also SSL Labs API expected error codes in the API docs v3.

Type of change

Breaking change - change of existing behaviour of retrying to call for the same host

Outcome

Avoid unnecessary retires on other expected or unexpected errors.

Expected errors refer to SSL Labs API expected error codes in the API docs v3.

400 - invocation error (e.g., invalid parameters)
500 - internal error
503 - the service is not available (e.g., down for maintenance)

API v4 for Qualys SSLLabs

Hello, just curious if you have plans or an ETA for supporting API v4 now that v3 has been deprecated? Thank you

https://notifications.qualys.com/api/2023/09/28/introduction-of-api-v4-for-qualys-ssllabs-and-deprecation-of-api-v3

Stuck on response code 441

Hi dev,

While scanning a list, i came across the below error, it seems the script can't get passed it to the next website test

Start analyzing testwebsite.com ...
Status: DNS, wait for 30 seconds...
Status: IN_PROGRESS, wait for 30 seconds...
Start analyzing xx.xxx.xxx.xxx:443 ...
Response code: 441 - Error on requesting API. Waiting 30 sec until next retry...
Response code: 441 - Error on requesting API. Waiting 30 sec until next retry...
Response code: 441 - Error on requesting API. Waiting 30 sec until next retry...
Response code: 441 - Error on requesting API. Waiting 30 sec until next retry...
Response code: 441 - Error on requesting API. Waiting 30 sec until next retry...
Response code: 441 - Error on requesting API. Waiting 30 sec until next retry...
Response code: 441 - Error on requesting API. Waiting 30 sec until next retry...
Response code: 441 - Error on requesting API. Waiting 30 sec until next retry...
Response code: 441 - Error on requesting API. Waiting 30 sec until next retry...
Response code: 441 - Error on requesting API. Waiting 30 sec until next retry...
Response code: 441 - Error on requesting API. Waiting 30 sec until next retry...
Response code: 441 - Error on requesting API. Waiting 30 sec until next retry...
Response code: 441 - Error on requesting API. Waiting 30 sec until next retry...
Response code: 441 - Error on requesting API. Waiting 30 sec until next retry...
Response code: 441 - Error on requesting API. Waiting 30 sec until next retry...
Response code: 441 - Error on requesting API. Waiting 30 sec until next retry...
Response code: 441 - Error on requesting API. Waiting 30 sec until next retry...
Response code: 441 - Error on requesting API. Waiting 30 sec until next retry...
Response code: 441 - Error on requesting API. Waiting 30 sec until next retry...
Response code: 441 - Error on requesting API. Waiting 30 sec until next retry...
Response code: 441 - Error on requesting API. Waiting 30 sec until next retry...
Response code: 441 - Error on requesting API. Waiting 30 sec until next retry...
Response code: 441 - Error on requesting API. Waiting 30 sec until next retry...
Response code: 441 - Error on requesting API. Waiting 30 sec until next retry...
Response code: 441 - Error on requesting API. Waiting 30 sec until next retry...
Response code: 441 - Error on requesting API. Waiting 30 sec until next retry...
Response code: 441 - Error on requesting API. Waiting 30 sec until next retry...
Response code: 441 - Error on requesting API. Waiting 30 sec until next retry...

Any help would be appreciated.

Update to build and test with Python 3.10 and drop Python 3.6

Proposed changes

Update to build and test also with 3.10
Drop 3.6 support

Type of change

Non-functional

failed to create process.

Hi,

I'm trying to run the ssllabs-scan command after the installation, but I keep getting the error "failed to create process". by the way, I'm also trying to run it on WSL and it is working perfectly fine.

Host: Windows 10
Python ver: 3.8.10
Pip ver: pip 21.3.1

Set parameters for SSL check

Hello,

it would be possible to add parameters critical / warning ??, to check the threshold

Regards

Some results are not coming in details/drownVulnerable json

Some results are not coming in details/drownVulnerable json;
Suggested change in ssllabsscan/ssllabs_client.py, line 142:

ep["details"].get("drownVulnerable", False)

Dependabot couldn't authenticate with https://pypi.python.org/simple/

Dependabot couldn't authenticate with https://pypi.python.org/simple/.

You can provide authentication details in your Dependabot dashboard by clicking into the account menu (in the top right) and selecting 'Config variables'.

View the update logs.

Feature request - report column for IP address

Would it be possible to have a column added to the report for IP address? This would help greatly for domains that return multiple hosts, so that the results could be differentiated between them. Google.com is an example, as is nctc.edu.

Thank you

do you need to run it from the ssllabs-scan directory?

This is great and so far useful.
I'm running it from the subdirectory(of the ssllabs-scan directory) that the input file is in and it is odd that working for some in the input file list and getting these errors for others in the list
i didn't want to run it in the main directory as trying to scan over 3000 sites

File "$BASEDIR/ssllabs-scan/bin/ssllabs-scan", line 11, in
load_entry_point('ssllabsscan', 'console_scripts', 'ssllabs-scan')()
File "$BASEDIR/ssllabs-scan/ssllabsscan/main.py", line 82, in main
return process(server_list_file=sys.argv[1])
File "$BASEDIR/ssllabs-scan/ssllabsscan/main.py", line 68, in process
traceback.print_stack()

Update unit tests to support SSL Labs API v3

Proposed changes

Update unit tests to support SSL Labs API v3

Type of change

Non-functional

Outcome

Unit tests are up-to-date for testing SSL Labs API v3.

Response code: 529 - Error on requesting API. Waiting 30 sec until next retry

Website scan is struck with above error.

Environment: Ubuntu

Dependabot couldn't authenticate with https://pypi.python.org/simple/

Dependabot couldn't authenticate with https://pypi.python.org/simple/.

You can provide authentication details in your Dependabot dashboard by clicking into the account menu (in the top right) and selecting 'Config variables'.

View the update logs.

kyhau / ssllabs-scan Goto Github PK

ssllabs-scan's Introduction

SSL Labs Scan

Built with

Input and outputs

Important Notes

Build and run

Linux

Windows

Docker

Example console output

Run Tox tests and build the wheels

ssllabs-scan's People

Stargazers

Watchers

Forkers

ssllabs-scan's Issues

Proposed changes

Type of change

Outcome

Proposed changes

Type of change

Proposed changes

Type of change

Outcome

Recommend Projects

Recommend Topics

Recommend Org