2

I would like to use a web browser to surf some sites while using the RC4 ciphers so I can verify if logging said connections is working on some load balancers.

Is there some way for me to enable and force RC4 requests on the browser?

I'm not confident that the online scanning tests (Qualys, etc.) are actually send a real life HTTPS request when testing since the logs do not show any RC4 connections during deprecated ciphers scans yet these scans detect the RC4 vulnerability.

Edit: I can use curl to test a particular cipher like shown below but I would like to still simulate the experience in a modern browser if possible. There could be a time where we redirect users or perform various actions based on what ciphers a browser is using.

curl -vvv -k https://www.example.com --ciphers 'RC4-SHA'

ARFETT
  • 21
  • 2
  • The level of logging you currently have set may not log unsuccessful connections. – EEAA Oct 26 '15 at 23:43
  • The logging happens before any actions are taken by the balancers. I was able to verify the logging works when testing via the curl command in my edited OP. – ARFETT Oct 27 '15 at 00:32

0 Answers0