New web attack on SSL/TLS using BEAST

@orinzo

 

 

You can manually verify the ciphers that are being accepted by a site by using

 

openssl s_client -connect bob.com:443 -cipher AES256-SHA <-testing each cipher from openssl ciphers.....

 

...but who wants to do that when we can script it??

 

and luckily, someone has built a pretty nice script already:

 

 

http://blog.techstacks.com/2009/01/verifying-ssl-ciphers.html

 

 

It will run through the openssl ciphers and tell you which ones the server responds to in a handshake.