CryptoLyzer

v1.2.0 suspicious
4.0
Medium Risk

Multi-protocol cryptographic configuration analyzer for TLS, SSH, DNS, and HTTP — alternative to testssl.sh and sslyze with Python API, 400+ cipher suites, vulnerability detection (FREAK, Logjam, ROBOT), and JA3/HASSH fingerprinting

🤖 AI Analysis

Final verdict: SUSPICIOUS

The package shows minimal risk in terms of network, shell, obfuscation, and credential handling. However, the metadata risk score due to the maintainer's lack of experience and single package raises some concerns.

  • Metadata risk due to inexperienced maintainer
  • Single package by the maintainer
Per-check LLM notes
  • Network: The use of 'requests.head' to check URI availability is generally benign but could be used in less transparent ways for external communications.
  • Shell: No shell execution patterns detected.
  • Obfuscation: No obfuscation patterns detected, indicating low risk.
  • Credentials: No credential harvesting patterns detected, indicating low risk.
  • Metadata: The maintainer's author name is missing and they seem to have only one package, which could indicate a less experienced or potentially suspicious actor.

🔬 Heuristic Checks

⚠ Outbound Network Calls score 1.5

Found 1 network call pattern(s)

  • : self.response = requests.head(transfer.uri, **requests_kwargs) except (requests.ex
✓ Code Obfuscation

No obfuscation patterns detected

✓ Shell / Subprocess Execution

No shell execution patterns detected

✓ Credential Harvesting

No credential harvesting patterns detected

✓ Typosquatting

No typosquatting candidates detected

✓ Registered Email Domain

Email domain looks legitimate: pfeifferszilard.hu>

✓ Suspicious Page Links

All external links appear legitimate

✓ Git Repository History

No GitHub repository linked

  • No GitHub repository link found
⚠ Maintainer History score 4.0

2 maintainer concern(s) found

  • Author name is missing or very short
  • Author "" appears to have only 1 package on PyPI (new or inactive account)
✓ Known CVE Vulnerabilities

No known vulnerabilities found in OSV database.

💡 AI App Starter Prompt

Use this prompt to build a project with CryptoLyzer 
Develop a comprehensive security assessment tool named 'CryptoGuard' using the Python package 'CryptoLyzer'. This tool aims to provide an easy-to-use interface for analyzing the cryptographic configurations of various network services including TLS, SSH, DNS, and HTTP. Users should be able to input the target host and port, select the service type, and initiate the scan. Upon completion, the tool will present a detailed report on the security posture of the target, highlighting any potential vulnerabilities such as FREAK, Logjam, or ROBOT attacks, and providing recommendations for improvement. Additionally, the tool should support the generation of JA3/HASSH fingerprints for easier identification of clients/servers during forensic investigations. Key functionalities include:

1. User-friendly command-line interface for specifying targets and initiating scans.
2. Real-time progress updates during the scanning process.
3. Detailed reports summarizing findings, including supported ciphersuites, detected vulnerabilities, and security recommendations.
4. Integration with popular logging frameworks for saving scan results.
5. Support for generating JA3/HASSH fingerprints.
6. Optional feature to send scan results via email or upload them to a cloud storage service.

The 'CryptoLyzer' package will be leveraged extensively throughout the development process, primarily for its extensive suite of tests across different protocols and its ability to detect over 400 ciphersuites. It also provides essential tools for identifying known vulnerabilities and generating unique fingerprints.