Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have developed an application that send binary data between a .NET client and Java server via TCP.

I have recently implemented SSL for this connection and would like a way to demonstrate that it is actually secure for my college project.

What tools would you recommend? I've used Cain and Abel before but I don't think it is really suitable for this?

Thanks.

share|improve this question

closed as off-topic by Scott Pack, TildalWave, Iszi, Xander, schroeder Sep 10 at 14:45

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

3 Answers 3

Openssl ships with a tool called "s_client" that can be used to test SSL servers. This is available for *nix, cygwin, and Win32.

Sample Usage

$ openssl s_client -connect servername:port -CAfile /path/to/ca.pem -debug -showcerts

There are a myriad of options such as -pause, -state, etc. which you may find useful for tracking SSL through its setup and teardown.

Security

In your original question, you wondered if your implementation was secure. By secure, do you mean that the stream is encrypted, or that you've implemented all aspects of the RFC correctly? If you mean the former, then use Wireshark as D.W. has pointed out.

If you mean the latter, then check out the OWASP SSL testing page. There's some great stuff there, but it is by no means exhaustive. These tests are geared for HTTPS, but they should work for any SSL implementation since it is analyzing the SSL protocol, not the application-level protocol on top.

share|improve this answer
    
+1. Suggest a usage example as well, since most people aren't familiar with this tool. –  tylerl Feb 29 '12 at 6:32

Here is a simple test you could start with: collect the traffic using Wireshark, and verify that the contents of the packets look like random noise (random bytes). That should be sufficient to check that you have turned on SSL.

If you're looking to test whether your SSL code works properly, you could also check whether you can interoperate with other SSL implementations.

As far as whether it is secure, well, that's a little bit broader. Here are some of the biggest ones. Did you use a well-vetted SSL library? (Implementing it yourself is not a good idea; it is too expensive to verify you haven't made any mistakes.) Did you seed it with an adequate source of entropy? (The good SSL libraries will do that for you automatically.) Did you hardcode the public key of the server properly, or properly check the server cert to make sure it corresponds to your server and not some imposter? Did you enable client authentication? Did you set the list of acceptable ciphersuites in a reasonable way? Did you use TLS 1.2? Are you aware that TLS only secures the communication channel, but you still need to make sure that the endpoints are secure, e.g., from various malicious attacks?

That might get you started.

share|improve this answer
1  
+1 for wireshark, it's also worth mentioning that if you've correctly implemented SSL, then Wireshark will flag the traffic as being SSL traffic as it can recognise the protocol. –  Rоry McCune Feb 28 '12 at 21:22

I use socat, and (occasionally) stunnel.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.