Skip to content

Result Documentation

Ethan edited this page May 11, 2020 · 6 revisions

HTTPS

implementation

Describes the state of the HTTPS implementation on the server and any issues therein

Reference:
* "Valid HTTPS" -- HTTPS implementation is complete
* "Downgrades HTTPS" -- Susceptible to the downgrading of secure HTTPS connections to HTTP
* "Bad Chain" -- HTTPS endpoint contains problematic certificate chain
* "Bad Hostname" -- HTTPS endpoint fails hostname validation

enforced

Describes the degree to which HTTPS is enforced on the server based on behaviour

Reference:
* "Strict" -- Defaults to HTTPS or immediately redirects HTTP to HTTPS
* "Moderate" -- HTTPS is present, but not in use by default. HTTP eventually redirects to HTTPS
* "Weak" -- HTTPS is present, but not in use by default. HTTP does NOT redirect to HTTPS
* "Not Enforced" -- Downgrades HTTPS and/or HTTPS endpoint fails hostname validation

hsts

Describes the presence and completeness of HSTS implementation

Reference:
* "HSTS Fully Implemented" -- HSTS in use and max-age is at least one year in length
* "HSTS Max Age Too Short" -- HSTS in use but max-age is less than one year in length
* "No HSTS" -- HSTS not implemented and/or non-existent max-age value

hsts_age

HSTS "max-age" directive value (in seconds). Denotes how long the domain should only be accessed using HTTPS

preload_status

Denotes whether the domain has been submitted and included within HSTS preload list

Reference:
* "HSTS Preloaded" -- Domain is included within HSTS preload list
* "HSTS Preload Ready" -- Domain is not included within HSTS preload list but is ready to be submitted to HSTS preload list
* "HSTS Not Preloaded" -- Domain is not included within HSTS preload list and is not ready for submission

expired_cert

Denotes whether HTTPS certificate in use is still valid

self_signed_cert

Denotes whether HTTPS certificate in use has been self-signed

SSL

SSL_2_0

Denotes support for SSL 2.0

SSL_3_0

Denotes support for SSL 3.0

TLS_1_0

Denotes support for TLS 1.0

TLS_1_1

Denotes support for TLS 1.1

TLS_1_2

Denotes support for TLS 1.2

TLS_1_3

Denotes support for TLS 1.3

rc4

Indicates whether any ciphers currently in use by the server utilize the RC4 stream cipher

3des

Indicates whether any ciphers currently in use by the server utilize the 3DES block cipher

strong_ciphers

List of ciphers in use by the server deemed to be "strong". These are ECDHE suites utilizing either GCM or CHACHA20

acceptable_ciphers

List of ciphers in use by the server deemed to be "acceptable". These suites make use of ECDHE or DHE, but do not utilize GCM or CHACHA20

weak_ciphers

List of ciphers in use by the server deemed to be "weak" or in other words, are not compliant with security standards. These suites do not make use of ECDHE or DHE and may utilize insecure ciphers such as RC4 or 3DES

acceptable_certificate

Certificate signed using either SHA256, SHA384 or AEAD

signature_algorithm

Signature algorithm used to sign Certificate

heartbleed

Denotes vulnerability to "Heartbleed" exploit

openssl_ccs_injection

Denotes vulnerability to OpenSSL CCS Injection

SPF

record

Sender Policy Framework (SPF) record for domain

valid

Denotes the validity of the domain's SPF record

dns_lookups

DNS lookups involved in analyzing domain's SPF record. More than 10 DNS lookups results in an invalid SPF record.

parsed

List of domains parsed for SPF record analysis, grouped by evaluated results (Pass/Neutral/Softfail/Fail)

parsed[pass]

List of domains for which it can be confidently stated that the host identity is used legitimately

parsed[neutral]

Equivalent to "none". No definitive statement can be made concerning the use of the host identity

parsed[softfail]

Identity should be scrutinized thoroughly. It is strongly suspected that the host is not authorized.

parsed[fail]

Host is not authorized.

parsed[include]

List of included SPF records and associated domains. These count toward the DNS lookup limit.

parsed[redirect]

Specifies a domain to redirect toward. This SPF record will be parsed. This counts toward the DNS lookup limit.

parsed[exp]

Explanation (Optional)

parsed[all]

Describes how to handle emails that do not match specified mechanisms

MX

hosts

List of hosts responsible for the receival of email on behalf of the domain

hosts[preference]

Numerical value indicating the preference of the host. The lowest value represents the most preferred host.

hosts[hostname]

Hostname associated with the MX record

hosts[addresses]

Address(es) associated with the MX record

hosts[tls]

Denotes host's support for tls

hosts[starttls]

Denotes host's support for starttls

hosts[warnings]

Any warnings generated while evaluating the MX (Mail Exchanger) record.

DMARC

record

Domain-based Message Authentication, Reporting and Conformance (DMARC) record for domain

valid

Denotes the validity of the domain's DMARC record

location

Base domain corresponding to the DMARC record

warnings

Any warnings generated while evaluating the DMARC record.

tags

List of tags from the domain's DMARC record and corresponding values/info

DKIM

t_value

Indicates that the domain is configured for testing DKIM

txt_record

DomainKeys Identified Email (DKIM) TXT record for domain

public_key_value

Value of the Public Key within the DKIM TXT record

key_size

Size of the Public Key in bits

key_type

Type of Public Key in use (e.g. RSA)

public_key_modulus

Result of performing modular division upon the Public Key

public_exponent

Exponent derived from performing modular division upon the Public Key