One of good tool to audit your website

Awesome online tool @CarySun. Tested mine and scored A+. By the way. OpenVAS (opensource) can flag SSL related issues as well. Being  long time I used Nexus, but it can also detect vuls in libraries and components that can affect SSL/TLS implementations

@Iams3le cool! Thank you for sharing.

Very cool testing tool. Will have to give this a try. 👍

Nice! I’m going to check this out! Thanks Cary.

Guys beware, running a Vulnerability Assessment (even a light one) on a customer site requires permission to be run. :)

BTW, the market leader is Nessus, it’s a super complete suite (not open source), while Greenbone OpenVas is another great solution as mentioned @Iams3le 

Personally I prefer BurpSuite, but for a direct interaction.

Oh, and there’s Shodan to check if that IP has know vulnerabilities.

I used Nessus back in the day. Did it not change from open source to proprietary? of am I confusing this with something else?

I think you’re confusing with OpenVas :) there’s a community version, but the main one is now proprietary! The old “gvc” via terminal!

I use the Qualys scanner every time I update a certificate on a public site.  Another tool that I use in conjunction with this is IISCrypto to disable/enable the appropriate SSL/TLS protocols, weed out weak ciphers and set cipher priorities without having to dig into the registry manually.

https://www.nartac.com/Products/IISCrypto

Also, don’t forget to check the “Don’t show the results on the boards” checkbox.  Sounds like a great way to publish weak websites if you ask me.

@dloseke Good to know. Thank you for sharing.

dloseke wrote:

Also, don’t forget to check the “Don’t show the results on the boards” checkbox.  Sounds like a great way to publish weak websites if you ask me.

 

 

Used that when I tested my blog.  Got a B across the board so need to look at CloudFlare which I use with it.

Chris.Childerhose wrote:

dloseke wrote:

Also, don’t forget to check the “Don’t show the results on the boards” checkbox.  Sounds like a great way to publish weak websites if you ask me.

 

 

Used that when I tested my blog.  Got a B across the board so need to look at CloudFlare which I use with it.

I just ran it on mine….aside from figuring out why my domain doesn’t like to pull up when not using a www. in front (it’s DNS of course), I’m happy with my result.

 

Here is a comprehensive article on Burpsuite.