NET Test Cases
This page details all Test Cases available through VSEC Test. All test cases can be run through the VSEC Test web app or via terminal on the Bench.
temp_ip and temp_mask parameters!Supported TLS Cipher Scan
Tries each TLS 1.2 and TLS 1.3 cipher suite that the Bench’s local OpenSSL build supports against the target and reports the suites the server accepts. Suites that the Bench’s OpenSSL does not support are not tested.
Fail Condition: If the server accepts any suite that is not on the test’s fixed allow-list, the test will be marked as failed. The allow-list holds TLS 1.2 ECDHE and DHE suites only, so a server that accepts a TLS 1.3 suite, or a suite whose OpenSSL name is not on the list, is reported as weak and fails.
Parameters
| Name | Default Value | Description |
|---|---|---|
| Network Interface | eth0 | The network interface on which to interact |
| Target IP | 10.1.0.1 | The IP to use when attempting to connect to |
| Target Port | 443 | The port to connect to |
| Temporary IP | A temporary IP address to set on the network interface, which will be reset after the test completes | |
| Temporary Subnet Mask | 255.255.255.0 | A temporary subnet mask to set on the network interface, which will be reset after the test completes |
Outcomes
SUCCESS: The specified TLS server accepted only suites on the allow-list.
Recommendations:
NO_RESPONSE (shown in VSEC as Error): The test failed to communicate with the specified target_host, or no TLS connection succeeded with any suite.
Recommendations:
- Check test parameters, physical connections and device power.
FAILURE: The specified TLS server accepted at least one suite that is not on the allow-list.
Recommendations:
- Review the destination of the offending TLS connection and modify that server’s configuration.
Example Usage
bw_cli run -a supported_tls_ciphers -p iface=eth0 -p target_host=10.1.0.1 -p target_port=443 -p temp_ip=10.1.0.12 -p temp_mask=255.255.255.0Supported TLS Version Scan
Attempts a connection to the target host with each version of TLS.
Fail Condition: If TLS 1.0 or 1.1 connects successfully the test will be marked as failed.
Parameters
| Name | Default Value | Description |
|---|---|---|
| Network Interface | eth0 | The network interface on which to interact |
| Target IP/hostname | 10.1.0.1 | The IP or hostname to use when attempting to connect to |
| Port | 443 | The port to connect to |
| Temporary IP | A temporary IP address to set on the network interface, which will be reset after the test completes | |
| Temporary Subnet Mask | 255.255.255.0 | A temporary subnet mask to set on the network interface, which will be reset after the test completes |
Outcomes
SUCCESS: The specified TLS server negotiates strong versions.
Recommendations:
NO_RESPONSE (shown in VSEC as Error): The test failed to communicate with the specified target_host
Recommendations:
- Check test parameters, physical connections and device power.
FAILURE: The specified TLS server allows negotiating weak versions.
Recommendations:
- Review the destination of the offending TLS connection and modify that server’s configuration.
Example Usage
bw_cli run -a supported_tls_versions -p iface=eth0 -p target_host=10.1.0.1 -p target_port=443 -p temp_ip=10.1.0.12 -p temp_mask=255.255.255.0Observed TLS Version
Listens on the network interface for 15 seconds and inspects the TLS ServerHello messages sent by the target host, checking that each negotiated TLS version is at least 1.2. Only connections where the target acts as the TLS server are judged.
Fail Condition: If the target sends a ServerHello that negotiates a version below TLS 1.2, this test will be marked as failed. If no traffic from the target is observed within the window, the test passes.
Parameters
| Name | Default Value | Description |
|---|---|---|
| Network Interface | eth0 | The network interface on which to interact |
| Target Host | 10.1.0.1 | The IP who’s packets to inspect |
Outcomes
SUCCESS: No ServerHello using an insecure TLS version was observed from the specified target_host. This includes the case where no traffic from the target was observed at all.
Recommendations:
- Check physical connections and device power.
- Ensure you are in a network position where target’s traffic will be seen by test
NO_RESPONSE (shown in VSEC as Error): The Target Host is not a valid IP address, or the Bench could not capture on the network interface.
Recommendations:
- Check the Target Host and Network Interface parameters.
FAILURE: Communication was observed originating from the target_host using an insecure TLS version.
Recommendations:
- Review the destination of the offending TLS connection and determine if this insecure protocol version can be replaced.
Example Usage
bw_cli run -a observed_tls_version -p iface=eth0 -p target_host=10.1.0.1SSH Password Authentication Check
Checks if an SSH server supports password authentication by attempting to connect to it.
Fail Condition: If the SSH Server does support password authentication, this test will be marked as failed.
Parameters
| Name | Default Value | Description |
|---|---|---|
| Network Interface | eth0 | The network interface on which to interact |
| Target IP | 10.1.0.1 | The IP to use when attempting to connect |
| Target Port | 8000 | The port to use when attempting to connect |
| Temporary IP | A temporary IP address to set on the network interface, which will be reset after the test completes | |
| Temporary Subnet Mask | 255.255.255.0 | A temporary subnet mask to set on the network interface, which will be reset after the test completes |
Outcomes
SUCCESS: The specified SSH server rejected password login.
Recommendations:
NO_RESPONSE (shown in VSEC as Error): The test could not open a network connection to the specified target_host. Other connection errors, for example a service on the port that does not speak SSH, give a pass instead.
Recommendations:
- Check test parameters, physical connections and device power.
FAILURE: The specified SSH server allows password login.
Recommendations:
- Review the offending SSH server and modify that server’s configuration.
Example Usage
bw_cli run -a ssh_pass_check -p iface=eth0 -p target_host=10.1.0.1 -p target_port=8000 -p temp_ip=10.1.0.12 -p temp_mask=255.255.255.0mTLS Self Signed Cert Connection
Attempts to connect to a mutual TLS service with a self signed certificate and expects to be rejected for invalid credentials.
Fail Condition: If any mTLS server accepts a connection with these invalid credentials the test will be marked failed.
Parameters
| Name | Default Value | Description |
|---|---|---|
| Network Interface | eth0 | The network interface on which to interact |
| mTLS URI | https://10.1.0.1:8883 | The URI of the mTLS Server to attempt to connect to |
| Temporary IP | A temporary IP address to set on the network interface, which will be reset after the test completes | |
| Temporary Subnet Mask | 255.255.255.0 | A temporary subnet mask to set on the network interface, which will be reset after the test completes |
Outcomes
SUCCESS: The connection with the self signed client certificate did not succeed. The test reports this result for any failed connection, including a server that could not be reached, so check the test output to confirm the server rejected the certificate.
Recommendations:
- Check test parameters, physical connections and device power.
FAILURE: The specified mTLS server allows authentication with self signed client certificates.
Recommendations:
- Review the destination of the offending TLS connection and modify that server’s configuration.
Example Usage
bw_cli run -a mtls_self_signed -p iface=eth0 -p uri=https://10.1.0.1:8883 -p temp_ip=10.1.0.12 -p temp_mask=255.255.255.0Telnet Check
Attempts to log in to a telnet server at the specified IP and port with the default credentials anonymous (empty password) and guest:guest.
Fail Condition: If either login succeeds and gives shell access, the test will be marked failed. A telnet server that answers but rejects both logins passes.
Parameters
| Name | Default Value | Description |
|---|---|---|
| Network Interface | eth0 | The network interface on which to interact |
| Target IP | 10.1.0.1 | The IP to use when attempting to connect to |
| Telnet Port | 23 | The port number to attempt to connect to telnet on |
| Temporary IP | A temporary IP address to set on the network interface, which will be reset after the test completes | |
| Temporary Subnet Mask | 255.255.255.0 | A temporary subnet mask to set on the network interface, which will be reset after the test completes |
Outcomes
SUCCESS: The specified Telnet server rejected the anonymous and guest:guest logins.
Recommendations:
- Ensure the credentials are secure and ideally unique per device.
NO_RESPONSE (shown in VSEC as Error): The test failed to communicate with the specified target_host
Recommendations:
- Check test parameters, physical connections and device power.
FAILURE: The specified Telnet server accepted the anonymous or guest:guest login and gave shell access.
Recommendations:
- Review the offending Telnet server and modify that server’s configuration.
Example Usage
bw_cli run -a telnet_check -p iface=eth0 -p target_host=10.1.0.1 -p target_port=23 -p temp_ip=10.1.0.12 -p temp_mask=255.255.255.0