SSLv3 check for various web browsers

If you didn't know it by now,  but  the various SSL versions are now no longer supported from a industry & security practice,  and have been that way for the most part or over the last  few months.

But did you know that many sites are still SSLv3 enabled across the internet?

Even worst, many internal org/enterprises have a host of  management  interfaces that are sill SSLv3 and have not migrated to a updated  code or enforce TLS1.x support with the applications.

This crucial lockdown step have been overlooked by many infomation-security teams.

Also many  webclients are still supporting SSLv3  unless you have actually upgraded the webclient.

Here's  a few screen shots that I put together for testing and validations

IE
 
FF

 
CHROME



I also used a older  Opera  44 version to show you what happens if your not up to date on client versions.


OPERA Did  launch prior to my update  & afterward my  browser just spins, but  with no warning


SAFARI   Version 10.1 (10603.1.30.0.34)



Vivaldi



Now you don't need a   to find a SSLv3 website, just use  the  openssl s_server function for testing

e.g



On a backend note,

"you can  easily find many clients and many sites that are negotiating  sslv3 by just looking at the   ClientHello/Server handshakes messages"


 You can do this with a simple tcp-packet grabber and pcap display filter for SSLv3 protocol.



Ken Felix

Ken Felix

NSE ( network security expert) and Route/Switching Engineer

kfelix  -----a----t---- socpuppets ---dot---com

     ^      ^

=(  @  @ )=

         o 

        /  \

 

How to use certreq tool to build a CSR on MS system

This comes up  numerous time with how to generate a SSL CSR  on a microsoft system. People believe that you need IIS installed to generate a CSR,  but that's not 100% true  & if you have the certreq tool.


In this example, I'm crafting a CSR that will  use "X509v3 Subject Alternative Names" and with a sha2 signature.

The  below  is the content of my values



The window's  cmd.exe needs to be ran as "Administrator" level ,  and then you can call the above saved  text from the cli for the generation of the  CSR.

certreq -new yournamedinitfile.txt <thecsrnamed_output>

 This will generate a base  CSR that can be uploaded to any CA for signing.








Key items to notice;

• the  "HashAlgorithm"  value is set to ensure sha1 is not used.
• DNS value are set for alternatveNames, just string out  the dns= value  for the altNames

Ken Felix

Ken Felix

NSE ( network security expert) and Route/Switching Engineer

kfelix  -----a----t---- socpuppets ---dot---com

     ^      ^

=(  @  @ )=

         o 

        /  \

The FortiAnalyzer language support is good, but still have holes

¿ Que Hablas ?

Reports in the fortianalyzer can be done in a wide variety of languages.

My experiences of working on various continents like Africa/Americas/Asia/EU,  this can come in  handy where English,  French, Portugese or Spanish could be used natively by the local audience.



 



Here's a snippets of a basic-reports done in a language that's  non English.

1st up  french;
















Take note of date/time format in the page title.


Now a Spanish report &  the same two sections.

note that  the  date/time is NOT in spanish for the title page  ;)


And finally  here the menu for Portuguese speakers which is the same for Spanish speakers.

FTNT has came a long way with  multiple language support  & this is a big selling point for MSSP outside the  North-American security community.

Ken Felix

NSE ( network security expert) and Route/Switching Engineer

kfelix  -----a----t---- socpuppets ---dot---com

     ^      ^

=(  @  @ )=

         o 

        /  \

using scp to push images into NXOS switches

In this post, I'm going to show you how simple  you can make the process  for  copy images into  NXOS.

Remember NXOS is wrapper  around the  unixOS so things like a SCP server are available as a feature.


1st step feature enable  scp-server  for the NXOS

e.g

    feature sap-server 

2nd step,  use your favorite scope client and copy the images to the  targets

e.g

    scp ./*images*  kfelix@10.1.1.1:

3rd you can even script this process with ease.

      ssh kfelix:mypassword@10.1.1.1  "config ; feature scp-server "

scp "images*" kfelix:mypassword@10.1.1.1:

 you can use passwords  ssh logins on nxos and with another AAA setup configured. The shekel will  be used for the authentication process

e.g 

  config  ; username kfelix ; username kfelix sshkey ssh-rsa    AAAAB3NzaC1yc2EAAAADAQABAAABAQC1f9FUinkkkjhftdjrdktg;lthjsyybu;s djky  drsd

Do any of the above will eliminate the need for stroking  a local ftp/tftp/ssh-server and allows any  scp-client to upgrade nxos switches with ease.

Ken Felix

Ken Felix

NSE ( network security expert) and Route/Switching Engineer

kfelix  -----a----t---- socpuppets ---dot---com

     ^      ^

=(  @  @ )=

         o 

        /  \

JumpCloud agent and proxies issues

I want to point out that transparent http-proxies could break the agent  function.

A good indication that this is happening can be obtained by looking at the jcagent.log  and the jump cloud portal


portal  { will show a inactive state }





log { errors on GET/POST to  JumpCLoud }




Your fix  to the above issues requires you to place exemptions policies for the  jump cloud agents based on the URL  method  https://agent.jumpcloud.com/* or use a explicit proxy.

Also  in  a bluecoat proxy it can provide  errors such as;



Also keep in mind  the CA authority is flagged via  most SSL site analysis tools

https://www.ssllabs.com/ssltest/analyze.html?d=agent.jumpcloud.com




HTbridge

https://www.htbridge.com/ssl/





Ken Felix

Ken Felix

NSE ( network security expert) and Route/Switching Engineer

kfelix  -----a----t---- socpuppets ---dot---com

     ^      ^

=(  @  @ )=

         o 

        /  \

FortiOs v5.2.11 upgrade as simple as 1 2 3

We just upgrade a FGT140D to fortiOS via the webgui quick upgrade feature. The upgrade happen faultless and is simple to execute.

Compared to a cisco ASA or Juniper SRX, the upgrade path and package is hands down one of the easiest appliance to upgrade.

Playing around with the 5.2.11 I was  still shocked to see SSLv2/3 is supported in  the SSL settings.

One thing that was confirm, even with SSLv2 enabled and forticlient can not  established a session.





Ken Felix

NSE ( network security expert) and Route/Switching Engineer

kfelix  -----a----t---- socpuppets ---dot---com

     ^      ^

=(  @  @ )=

         o 

        /  \

time is all that we have ( tips for FortiOS )

Every second we are getting older ;)

Here's some fortigate time tricks/tips

Here's a  few ways to find system time  if you don't have WebGUI access

1> cat proc  RTC  deteilas, time will be in UTC

fnsysctl cat /proc/driver/rtc

rtc_time        : 18:51:01

rtc_date        : 2017-05-09

rtc_epoch       : 1900

alarm           : **:**:**

DST_enable      : no

BCD             : yes

24hr            : yes

square_wave     : no

alarm_IRQ       : no

update_IRQ      : no

periodic_IRQ    : no

periodic_freq   : 1024

batt_status     : okay

2>  Get system status

FWSOC01 # get system status | grep time

System time: Tue May  9 11:51:27 2017

3>  Get the administrator status

FWSOC01 #  get sys admin status | grep current

current time: 2017-05-09 11:51:29

4>  Create a REV backup and immediately list the  REV, the timestamp would be the current time

execute backup config flash  BLOG

execute revision  list config

5>  Or just execute a time

execute  time




Ken Felix

NSE ( network security expert) and Route/Switching Engineer

kfelix  -----a----t---- socpuppets ---dot---com

     ^      ^

=(  @  @ )=

         o 

        /  \