{"id":25854622,"url":"https://github.com/bugnificent/security-test","last_synced_at":"2025-10-10T10:40:28.123Z","repository":{"id":275134424,"uuid":"925173277","full_name":"bugnificent/security-test","owner":"bugnificent","description":"Security Test Result as JSON format of my domain using Wireshark.","archived":false,"fork":false,"pushed_at":"2025-01-31T11:37:54.000Z","size":22,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-02-23T19:55:14.698Z","etag":null,"topics":["json","network-analysis","wireshark"],"latest_commit_sha":null,"homepage":"https://yusufasik.com","language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/bugnificent.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2025-01-31T11:23:22.000Z","updated_at":"2025-01-31T11:37:57.000Z","dependencies_parsed_at":"2025-01-31T12:41:32.896Z","dependency_job_id":null,"html_url":"https://github.com/bugnificent/security-test","commit_stats":null,"previous_names":["velespitt/security-test","bugnatis/security-test","bugnificent/security-test"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/bugnificent%2Fsecurity-test","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/bugnificent%2Fsecurity-test/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/bugnificent%2Fsecurity-test/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/bugnificent%2Fsecurity-test/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/bugnificent","download_url":"https://codeload.github.com/bugnificent/security-test/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":241389153,"owners_count":19955107,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["json","network-analysis","wireshark"],"created_at":"2025-03-01T16:17:11.438Z","updated_at":"2025-10-10T10:40:28.113Z","avatar_url":"https://github.com/bugnificent.png","language":null,"funding_links":[],"categories":[],"sub_categories":[],"readme":"# Wireshark TLS Handshake/ZAP Scan Data - `yusufasik.com`\n\nThis repository contains a JSON file generated from Wireshark capturing TLS handshake data for HTTP/HTTPS requests where the `Server Name Indication (SNI)` matches `\"yusufasik.com\"`. Additionally, this repository includes automated security scan reports generated by **ZAP (Zed Attack Proxy)** and **Checkmarx** to ensure the security and integrity of the domain's communication.\n\n---\n\n## Overview\n\nThe captured data includes detailed information about the SSL/TLS handshake process for requests that reference the domain `yusufasik.com`. This JSON file contains all relevant information regarding the server's public key, cipher suites, and other key aspects of the SSL/TLS connection setup. The repository also includes automated security scan reports to analyze potential vulnerabilities and ensure secure communication.\n\n---\n\n## File Structure\n\n### JSON File (Wireshark Data)\nThe JSON file consists of the following data:\n\n- **Source and Destination IP**: The IP addresses involved in the connection.\n- **TLS Handshake Information**: Details about the TLS handshake, including protocol versions, cipher suites, and extensions.\n- **Server Name Indication (SNI)**: The domain name (`yusufasik.com`) used during the handshake.\n- **Session Keys**: Information related to the session setup (if decrypted or relevant).\n\n### Automated Security Scan Reports\n- **ZAP Report**: An `.html` file containing the results of an automated security scan performed by OWASP ZAP (Zed Attack Proxy).\n- **Checkmarx Report**: A report generated by Checkmarx Static Application Security Testing (SAST) tool, analyzing the source code for security vulnerabilities.\n\n---\n\n## Purpose\n\nThe purpose of this repository is to provide a comprehensive record of TLS handshakes for the domain `yusufasik.com`, along with automated security scan reports. This data can be used for:\n\n- **Security analysis**: Inspecting how the TLS handshake is conducted for this domain and identifying potential vulnerabilities.\n- **Network troubleshooting**: Understanding the communication process and identifying potential issues with HTTPS connections.\n- **Compliance and auditing**: Ensuring the domain is using secure protocols and certificates for encrypted communication.\n- **Vulnerability assessment**: Using ZAP and Checkmarx reports to identify and remediate security risks in the application and network communication.\n\n---\n\n## How to Use\n\n### Viewing the Wireshark JSON Data\n1. Open the JSON file in any JSON viewer or text editor.\n2. Examine the details of the TLS handshake, focusing on the fields related to the `SNI` and cipher suites.\n3. Use the file for further analysis of SSL/TLS handshake security or to investigate specific network requests involving the domain `yusufasik.com`.\n\n### Example of a Typical Entry\n\n```json\n{\n  \"frame_number\": 1,\n  \"timestamp\": \"2025-01-30T12:34:56.789\",\n  \"source_ip\": \"192.168.1.10\",\n  \"destination_ip\": \"93.184.216.34\",\n  \"tls_handshake\": {\n    \"protocol_version\": \"TLS 1.2\",\n    \"cipher_suite\": \"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256\",\n    \"extensions\": {\n      \"server_name\": \"yusufasik.com\"\n    }\n  }\n}\n```\n\n### Interpreting the ZAP Report\nThe ZAP report is an `.html` file that provides detailed insights into potential security issues, such as:\n- **Cross-Site Scripting (XSS)**\n- **SQL Injection**\n- **Insecure HTTP Headers**\n- **Broken Authentication**\n- **Security Misconfigurations**\n\n#### Steps to Use:\n1. Open the `.html` file in your browser.\n2. Review the **Alerts** section, categorized by severity (High, Medium, Low, Informational).\n3. Follow the **Recommendations** provided to address identified vulnerabilities.\n4. Mark any **False Positives** as resolved if they are not applicable.\n\n---\n\n## How to Generate the Files\n\n### Wireshark JSON File\nThe JSON file was generated using Wireshark with the following filter applied:\n\n```sql\ntls.handshake.extensions_server_name contains \"yusufasik.com\"\n```\n\n### Steps for Generating the File:\n1. **Capture Traffic**: Use Wireshark to capture network traffic on the desired network interface.\n2. **Apply the Filter**: Apply the filter `tls.handshake.extensions_server_name contains \"yusufasik.com\"` to capture only traffic related to the `yusufasik.com` domain.\n3. **Export to JSON**: Export the filtered packet capture to a JSON file format.\n4. **Save the File**: Store the file for later analysis or reporting.\n\n### ZAP and Checkmarx Reports\n1. **Run ZAP Scan**:\n   - Use OWASP ZAP to perform an automated security scan on the domain or application.\n   - Export the results as an `.html` file.\n2. **Run Checkmarx Scan**:\n   - Use the Checkmarx SAST tool to analyze the source code for vulnerabilities.\n   - Export the results in the desired format.\n\n---\n\n## Tools Used\n- **Wireshark**: Network protocol analyzer for capturing the TLS handshake and generating the JSON file.\n- **OWASP ZAP**: Open-source tool for finding vulnerabilities in web applications.\n- **Checkmarx**: Static Application Security Testing (SAST) tool for analyzing source code for security vulnerabilities.\n- **JSON**: Standard data format used for storing and exchanging structured information.\n\n## Contributing\n\nIf you would like to contribute to this repository:\n\n1. Fork the repository.\n2. Make your changes or add new accessibility testing results.\n3. Submit a pull request for review.\n\n## License\nThis project is licensed under the [Apache License](LICENSE) \n\n---\n\nFor questions or suggestions, feel free to create an issue in this repository.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fbugnificent%2Fsecurity-test","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fbugnificent%2Fsecurity-test","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fbugnificent%2Fsecurity-test/lists"}