upgrade sslyze version

wapiti-scanner · Mar 5, 2023 · 9fa59f1 · 9fa59f1
1 parent 3615593
commit 9fa59f1
Show file tree

Hide file tree

Showing 4 changed files with 45 additions and 34 deletions.
diff --git a/Pipfile b/Pipfile
@@ -25,7 +25,7 @@ aiosqlite = "==0.17.0"
 loguru = ">=0.5.3"
 dnspython = "==2.1.0"
 httpcore = "==0.16.3"
-sslyze = "==5.0.6"
+sslyze = "==5.1.1"
 humanize = "==4.4.0"
 mitmproxy = "==9.0.0"
 typing-extensions = "==4.4.0"

diff --git a/Pipfile.lock b/Pipfile.lock
diff --git a/setup.py b/setup.py
@@ -130,7 +130,7 @@ def run_tests(self):
     extras_require={
         "NTLM": ["httpx-ntlm"],
         "sslyze": [
-            "sslyze==5.0.6",
+            "sslyze==5.1.1",
             "humanize==4.4.0",
             "pydantic==1.10.2",  # This is to avoid a conflict with sslyze
         ]

diff --git a/wapitiCore/attack/mod_ssl.py b/wapitiCore/attack/mod_ssl.py
@@ -20,11 +20,13 @@
 from os.path import join as path_join
 from typing import List, Tuple, Optional
 from collections import defaultdict
+from itertools import chain
 
 import humanize
 from cryptography.hazmat.primitives.asymmetric.ec import EllipticCurvePublicKey
 from cryptography import x509
-from sslyze.plugins.certificate_info._certificate_utils import get_common_names, extract_dns_subject_alternative_names
+from sslyze.plugins.certificate_info._certificate_utils import get_common_names, \
+    parse_subject_alternative_name_extension
 from sslyze.plugins.robot.implementation import RobotScanResultEnum
 from sslyze import ServerNetworkLocation, ServerNetworkConfiguration, ScanCommand, Scanner, ServerScanRequest, \
     ScanCommandAttemptStatusEnum
@@ -70,7 +72,9 @@ def process_certificate_info(certinfo_result):
         log_blue(message)
         yield INFO_LEVEL, message
 
-        message = f"Alt. names: {extract_dns_subject_alternative_names(leaf_certificate)}"
+        alt_names = parse_subject_alternative_name_extension(leaf_certificate)
+        alt_names = ", ".join(chain(alt_names.dns_names, alt_names.ip_addresses))
+        message = f"Alt. names: {alt_names}"
         log_blue(message)
         yield INFO_LEVEL, message