Blog - RapydBlok

January ’21 updates released for RapydBlok INSPECT

RapydBlok Inspect

adm1n | January 26, 2021

𝗡𝗲𝘄 𝘂𝗽𝗱𝗮𝘁𝗲𝘀 released for 𝙍𝙖𝙥𝙮𝙙𝘽𝙡𝙤𝙠 𝙄𝙉𝙎𝙋𝙀𝘾𝙏 – [Jan 2021]

[𝓢𝓬𝓪𝓷 𝓽𝓸 𝓲𝓷𝓼𝓹𝓮𝓬𝓽 𝔀𝓮𝓫𝓼𝓲𝓽𝓮 𝓱𝓽𝓽𝓹𝓼 𝓼𝓮𝓬𝓾𝓻𝓲𝓽𝔂]

1: [𝙄𝙢𝙥𝙧𝙤𝙫𝙚] – Results page ‘Issued To’ section. Changed name of ‘Issuer:’ to ‘Common Name’ and changed ‘Organization’ data to be more accurate.
2: [𝘽𝙪𝙜 𝙁𝙞𝙭𝙚𝙨] – Email not sending latest updated scan results, when url was previously scanned.
3: [𝘽𝙪𝙜 𝙁𝙞𝙭𝙚𝙨] – Email intermittently sent with a new url scan.
4: [𝙐𝙥𝙜𝙧𝙖𝙙𝙚] – Updated testssl scanning engine to the latest version, with bug fixes & improvements, see https://github.com/drwetter/testssl.sh

[𝗦𝗖𝗔𝗡] – https://inspect.rapydblok.com

Follow us on Twitter | Facebook | LinkedIN

SSL Scan information page

RapydBlok – 2020 in Review

RapydBlok Inspect

adm1n | December 11, 2020

“HTTPS & SSL doesn’t mean “trust this.” It means “this is private.” You may be having a private conversation with Satan.” – Scott Hanselman

“Best wishes for the festive season from the RapydBlok team. 2020 hasn’t been the easiest year for most, but with all it’s challenges we have persevered. Well wishes for 2021 are in order.”

RapydBlok achieved some milestones this year including;

A new product, INSPECT Web App, that can inspect website https security – inspect.rapydblok.com
Fixed some bugs, added multi-threading for SCANS and improved on reporting and email delivery of results.
Introduced #ScanFriday, to encourage regular security scanning.
Gordon emigrated from Cape Town to Munich.

𝗛𝗼𝘄 𝗰𝗮𝗻 𝗜𝗡𝗦𝗣𝗘𝗖𝗧 𝗵𝗲𝗹𝗽 𝗺𝗲 – Most websites have SSL certificates to secure web traffic, 𝗜𝗡𝗦𝗣𝗘𝗖𝗧 will review the SSL certificate & web server configuration for any related issues and display the full results.

Summary of the common issues found during SSL scans;

It’s not secure enough to just install an SSL certificate, correct configuration is key!

𝙅𝙪𝙨𝙩 𝙞𝙣𝙨𝙩𝙖𝙡𝙡𝙞𝙣𝙜 𝙖𝙣 𝙎𝙎𝙇 𝙘𝙚𝙧𝙩𝙞𝙛𝙞𝙘𝙖𝙩𝙚 𝙞𝙨 𝙣𝙤𝙩 𝙚𝙣𝙤𝙪𝙜𝙝 𝙩𝙤 𝙨𝙚𝙘𝙪𝙧𝙚 𝙏𝙇𝙎/𝙎𝙎𝙇, it needs to be configured correctly on the web server & some web admins are unaware of this.
𝘿𝙚𝙥𝙧𝙚𝙘𝙞𝙖𝙩𝙚𝙙 𝙋𝙧𝙤𝙩𝙤𝙘𝙤𝙡𝙨 𝙖𝙧𝙚 𝙘𝙤𝙣𝙛𝙞𝙜𝙪𝙧𝙚𝙙, mainly TLS 1 & TLS1.1 are offered in configuration but actually depreciated. Min of TLS v1.2 and TLS 1.3 should be offered.
𝙐𝙨𝙞𝙣𝙜 𝙤𝙗𝙨𝙤𝙡𝙚𝙩𝙚 𝙤𝙧 𝙤𝙡𝙙 𝙘𝙞𝙥𝙝𝙚𝙧𝙨, for certificates often requires a review and Mozilla has some good recommendations on ciphers & client support.
𝙑𝙪𝙡𝙣𝙚𝙧𝙖𝙗𝙞𝙡𝙞𝙩𝙞𝙚𝙨, if old or obsolete Ciphers and Protocols are used, it can generally lead to vulnerabilities being available for that host.
𝙎𝙚𝙘𝙪𝙧𝙞𝙣𝙜 𝙬𝙞𝙩𝙝 TLS 1.3 𝙤𝙣𝙡𝙮, doesn’t allow for all web clients to connect, especially older ones but most importantly Internet Explorer users cant connect.

Shoutout to the testssl.sh team, without them there wouldn’t be an INSPECT product

Keep watching this space in 2021, the RapydBlok team will keep pushing the limits and do some great releases.

All the best, Fröhliche Weihnachten & Happy Holidays

Gordon Bishop – co-founder

August updates released for RapydBlok INSPECT

RapydBlok Inspect

adm1n | August 19, 2020

The RapydBlok team have been testing and finding ways to improve on the initial release, the below are updates released for RapydBlok INSPECT in August 2020;

[Scan to inspect website https security]

1: [New] – New option to receive results via email, email used once-off and not stored.
2: [Improve] – Option added to download full html report.
3: [Improve] – Multi-threading added for scans to improve scanning times.
4: [Bug Fixes] – Two minor bugs resolved.

[SCAN] – https://inspect.rapydblok.com

5: [Listed] – RapydBlok INSPECT has been listed on https://github.com/drwetter/testssl.sh as an ‘External/related project’

RapydBlok INSPECT main page

RapydBlok INSPECT Web App is Live

RapydBlok Inspect

adm1n | August 5, 2020

RapydBlok is proud to announce that the ‘RapydBlok INSPECT’ product is finished and in production!

After many cups of coffee, weeks of planning, development & fine tuning, the team have produced a free web app to audit TLS/SSL configurations.

What is RapydBlok INSPECT?

– INSPECT is a free Web application that can audit & report on TLS/SSL ciphers & protocols for configuration issues, cryptographic flaws, vulnerabilities, HTTP security headers. INSPECT is built upon the foundations of the open source, testssl.sh toolset.

How can that help me?

– Most websites have SSL certificates to secure web traffic, INSPECT will review your SSL certificate and web server configuration for any related issues and display the full results.

Run a SCAN: inspect.rapydblok.com

What are the common issues found so far?

1: Just installing an SSL certificate is not enough to secure TLS/SSL, it needs to be configured correctly on the web server & some web admins are unaware of this.

2: Depreciated Protocols are configured, mainly TLS 1 & TLS1.1 are offered in configuration but actually depreciated. Min of TLS v1.2 and TLS 1.3 should be offered.

3: Using obsolete or old ciphers, for certificates often requires a review and Mozilla has some good recommendations on ciphers & client support.

4: Vulnerabilities, if old or obsolete Ciphers and Protocols are used, it can generally lead to vulnerabilities being available for that host.

5: Securing only with TLS1.3, doesn’t allow for all web clients to connect, especially older ones but most importantly Internet Explorer users cant connect.

6: Host scanned multiple times, hosts are being scanned around 3 times on average, as configuration changes are done in small stages, and confirmed correct via re-scans.

Results page screenshots;

RapydBlok INSPECT Audit SSL

RapydBlok Inspect product is in active development

RapydBlok Inspect

adm1n | July 19, 2020

RapydBlok Inspect

RapydBlok.com is current building a new product called “Inspect”. RapydBlok Inspect will be a free web application (webapp) that will be able to audit and report on hosts TLS/SSL ciphers and protocols for configuration issues, cryptographic flaws, vulnerabilities, HTTP security headers and more.

We will be building this service upon a solid foundation, using the open source testssl.sh toolset (https://testssl.sh) from Dr Wetter and team.

The RapydBlok Inspect product will not only offer a webapp but also an Application Programming Interface (API), which will allow 3^rd party integrations.

Keep watching this space..

January ’21 updates released for RapydBlok INSPECT

RapydBlok – 2020 in Review

August updates released for RapydBlok INSPECT

RapydBlok INSPECT Web App is Live

RapydBlok is proud to announce that the ‘RapydBlok INSPECT’ product is finished and in production!

RapydBlok Inspect product is in active development

Recent Posts

Archives

Categories

Share

Share

Share

RapydBlok is proud to announce that the ‘RapydBlok INSPECT’ product is finished and in production!

Share

Share

Recent Posts

Archives

Categories