README
tlsfuzzer
tlsfuzzer is a test suite for SSLv2, SSLv3, TLS 1.0, TLS 1.1, TLS 1.2, and TLS 1.3 implementations. It's in early stages of development, so there are no API stability guarantees. While it uses fuzzing techniques for testing (randomisation of passed in inputs), the scripts are generally written in a way that verifies correct error handling: unlike typical fuzzers it doesn't check only that the system under test didn't crash, it checks that it returned correct error messages.
You can find ready-to-use scripts testing for many vulnerabilities (
ROBOT,
DROWN, etc.)
and general standards conformity
(RFC 5246,
RFC 7627,
RFC 7905, etc.) in the scripts/
directory.
Dependencies
You'll need:
- Python 2.6 or later or Python 3.6 or later
- tlslite-ng
0.8.1 or later (note that
tlslitewill not work and they conflict with each other)