Deeps-2005/java-ssl-scanner

1import javax.net.ssl.*;
2import java.security.cert.X509Certificate;
3
4public class TestCipherBug { // Class name remains AllVulnerabilitiesTest
5    public static void main(String[] args) throws Exception {
6        // ❌ Insecure TrustManager
7        TrustManager[] trustAll = new TrustManager[] {
8            new X509TrustManager() {
9                public X509Certificate[] getAcceptedIssuers() { return null; }
10                public void checkClientTrusted(X509Certificate[] certs, String authType) { }
11                public void checkServerTrusted(X509Certificate[] certs, String authType) { } // FIX: Removed extra 'void' here
12            }
13        };
14
15        // ❌ Insecure HostnameVerifier
16        HttpsURLConnection.setDefaultHostnameVerifier((hostname, session) -> true);
17
18        // ❌ Weak Cipher Suites
19        SSLSocket socket = (SSLSocket) SSLSocketFactory.getDefault().createSocket();
20        socket.setEnabledCipherSuites(new String[]{"TLS_RSA_WITH_NULL_MD5"});
21
22        // ❌ Debug Logging Enabled
23        System.setProperty("javax.net.debug", "ssl");
24
25        // ❌ TLS Renegotiation not disabled
26        System.setProperty("com.ibm.jsse2.renegotiate", "ALLOW");
27
28        // ❌ Potential DoS via Handshake Flooding
29        SSLServerSocketFactory ssf = (SSLServerSocketFactory) SSLServerSocketFactory.getDefault();
30        SSLServerSocket sss = (SSLServerSocket) ssf.createServerSocket(8443);
31        while (true) {
32            sss.accept(); // endless handshake
33        }
34    }
35}
36