O-Saft is an easy to use tool to show informations about SSL certificate and tests the SSL connection according given list of ciphers and various SSL configurations.
It's designed to be used by penetration testers, security auditors or server administrators. The idea is to show the important informations or the special checks with a simple call of the tool. However, it provides a wide range of options so that it can be used for comprehensive and special checks by experienced people.
O-Saft is a command-line tool, so it can be used offline and in closed environments. There is also a GUI based on Tcl/Tk. However, it can simply be turned into an online CGI-tool (please read documentation first).
The main idea is to have a tool which works on common platforms and can simply be automated.
New Features of Test Version
What is O-Saft?
(These presentations are in German)
OWASP O-Saft is free to use. It is licensed under the GPL v2 license.
News and Events
In Print / Media
Find a OWASP 24/7 podcast about the tool here.
- Where can I get missing Perl-Modules?
This depends on your OS and Perl installation, but just try cpan <Module-Name>, e.g. cpan Net:DNS
- I am connected to the internet via a Proxy
open the cpan-shell using 'cpan' and configure your proxy settings: 'o conf init /proxy/'
- I can not download the requested files (the proxy needs authentication)
run 'cpan <Module-Name>' several times, read the error messages and copy the requested files manually to the paths (without any additional temporary extension of the name),
e.g. http://www.cpan.org/authors/01mailrc.txt.gz => <Your Program Path>/cpan/sources/authors/01mailrc.txt.gz
- I am connected to the internet via a Proxy
- I get the Error "invalid SSL_version specified at .../perl/vendor/lib/IO/Socket/SSL.pm line ..."
- add options --notlsv13 --nodtlsv1, e.g. perl o-saft.pl +info your.tld --notlsv13 --nodtlsv1
- use +cipherall to check the ciphers for all protocols
- My local SSL libraries do *not* support legacy Protocols like SSLv2, SSLv3 or legacy Ciphers
- use o-saft.pl for all protocols that are supported by your local computer
- use o-saft.pl +cipherall (or 'checkAllCiphers.pl') to get the ciphers for the missing protocols, or recompile 'Net::SSLeay' and/or openssl to support more protocols and ciphers, see Documentation INSTALLATION for details
- I can not use the latest features of the test (experimental) version
- Please verify that you downloaded and unpacked the 'master.zip'-Archive
- some new functions are protected by the option --experimental, please add it to your command (and take care what happens)
- o-saft.pl seems to hang
- try one or all of following options (see Documentation Performance Problems);
- --no-dns -no-http --no-cert --no-sni --no-openssl
O-Saft is developed by from the contributions of OWASP members. The primary contributors to date have been:
O-Saft's source code can be found at https://github.com/OWASP/O-Saft .
The latest stable tarball is https://github.com/OWASP/O-Saft/raw/master/o-saft.tgz
- Road Map
- Involvement in the development and promotion of O-Saft is actively encouraged!
You do not have to be a security expert in order to contribute. Contacts:
- mailto: Achim at owasp dot org
Some of the ways you can help:
- Quality assurance: simply test O-Saft and report defects and strange responses of servers
- Give some ideas how to implement scoring
- Need help in implementing
- authentication for proxies (BASIC, NTLM)
- check for more SSL/TLS-Extensions (including obsolete ones)
- check for more vulnerabilities
- check the full certificate chain
- 17.11.2017 Dockerfile improved; +cipherall improved; bugfix: no prefered cipher for SSLv2; bit-length for serial number corrected
- 17.09.2017 docker build openssl with GOST and KRB5 ciphers; bugfix for BEAST and sub-domain checks
- 17.07.2017 docker image supported; performance improved; support unresponsive targets
- 17.04.2017 ALPN and NPN support improved
- 17.01.2017 checking OCSP improved; certificate verification corrected; performance improved
- 09.09.2016 GUI improved
- 30.08.2016 Check for new vulnerabilities DROWN
- 30.08.2016 Check for new vulnerabilities Sweet32
- 16.07.2016 new commands (checks) for STS preload, HSTS preload HSTS http-equiv
- 16.05.2016 code quality improved using perlcritic
- 15.12.2015 Stable Release 15.12.15
- 15.11.2015 Stable Release 15.11.15
- 08.01.2015, stable release 15.01.07
- 05.04.2015, simple GUI available o-saft.tcl
- 07.12.2014, stable release 14.12.07
- 16.11.2014, stable release 14.11.14
- 15.10.2014, check for Poodle vulnerability, see test version: master.zip
- 10.04.2014 Heartbleed check, see https://github.com/OWASP/O-Saft
- Stable Release (17.06.17): o-saft.tgz
- Stable Release (17.05.17): o-saft.tgz
- Stable Release (17.04.17): o-saft.tgz
- Stable Release (17.03.17): o-saft.tgz
- Stable Release (16.12.16): o-saft.tgz
- Stable Release (16.11.16): o-saft.tgz
- Stable Release (16.09.16): o-saft.tgz
- Stable Release (15.12.15): o-saft.tgz