Adding Vulnerability Scans to Scan

scan/scan_common.go

@@ -121,11 +121,12 @@ type FamilySet map[string]*Family
 
 // Default contains each scan Family that is defined
 var Default = FamilySet{
-	"Connectivity": Connectivity,
-	"TLSHandshake": TLSHandshake,
-	"TLSSession":   TLSSession,
-	"PKI":          PKI,
-	"Broad":        Broad,
+	"Vulnerability": Vulnerability,
+	"Connectivity":  Connectivity,
+	"TLSHandshake":  TLSHandshake,
+	"TLSSession":    TLSSession,
+	"PKI":           PKI,
+	"Broad":         Broad,
 }
 
 // ScannerResult contains the result for a single scan.

scan/vulnerability.go

@@ -0,0 +1,119 @@
+package scan
+
+import (
+	"crypto/rsa"
+	"crypto/x509"
+	"errors"
+	"net/url"
+
+	"github.com/FiloSottile/Heartbleed/heartbleed"
+	"github.com/cloudflare/cfssl/certinfo"
+	"github.com/cloudflare/cfssl/helpers"
+)
+
+// Vulnerability contains scanners to detect vulnerabilities such as Heartbleed
+var Vulnerability = &Family{
+	Description: "Scans a host to detect TLS vulnerabilities.",
+	Scanners: map[string]*Scanner{
+		"Heartbleed": {
+			"Scan for Heartbleed vulnerability",
+			heartbleedScan,
+		},
+		"BERserk": {
+			"Scan for BERserk vulnerability",
+			BERserkScan,
+		},
+		"LogJam": {
+			"Scan for LogJam vulnerability",
+			LogJamScan,
+		},
+	},
+}
+
+func heartbleedScan(addr, hostname string) (grade Grade, output Output, err error) {
+	tgt := &heartbleed.Target{
+		Service: "https",
+		HostIp:  hostname,
+	}
+
+	u, err := url.Parse(tgt.HostIp)
+	if err == nil && u.Host != "" {
+		tgt.HostIp = u.Host
+	}
+
+	out, err := heartbleed.Heartbleed(tgt,
+		[]byte("github.com/FiloSottile/Heartbleed"), true)
+	if err == heartbleed.Safe {
+		grade = Good
+		err = nil
+	} else if err != nil {
+		grade = Warning
+	} else {
+		grade, output = Bad, out
+	}
+	return
+}
+
+func BERserkScan(addr, hostname string) (grade Grade, output Output, err error) {
+	// Vulnerable if certificate has a 3 as the public exponent
+	// get certificate from host via certinfo
+
+	certData, err := certinfo.ParseCertificateDomain(hostname)
+	if err != nil {
+		grade = Bad
+		return
+	}
+
+	ca, err := helpers.ParseCertificatePEM([]byte(certData.RawPEM))
+	if err != nil {
+		grade = Bad
+		return
+	}
+
+	if ca.PublicKeyAlgorithm != x509.RSA {
+		grade = Good
+	}
+
+	pub, ok := ca.PublicKey.(*rsa.PublicKey)
+	if !ok {
+		grade = Good
+	}
+
+	if pub.E == 3 {
+		grade = Bad
+		err = errors.New("certificate has RSA public exponent 3 and is vulnerable")
+	}
+
+	if pub.N.BitLen() == 1024 || pub.N.BitLen() == 2048 {
+		grade = Bad
+		err = errors.New("certificate has bad public key length")
+	}
+	return
+}
+
+func LogJamScan(addr, hostname string) (grade Grade, output Output, err error) {
+	// do a DHE handshake and look at the public exponent used by the server.
+	// If it’s 1024 bits, then it’s vulnerable.
+
+	//DHE handshake?
+	certData, err := certinfo.ParseCertificateDomain(hostname)
+	if err != nil {
+		grade = Bad
+		return
+	}
+
+	ca, err := helpers.ParseCertificatePEM([]byte(certData.RawPEM))
+	if err != nil {
+		grade = Bad
+		return
+	}
+
+	pub, _ := ca.PublicKey.(*rsa.PublicKey)
+	if pub.N.BitLen() == 1024 {
+		grade = Bad
+		err = errors.New("unsupported public key length")
+		return
+	}
+	grade = Good
+	return
+}