💡
🕶️
🚬
A set of badly configured XMPP services for testing against. Inspired by https://badssl.com/.
A list of hosts can be found by a disco#items
query to badxmpp.eu
which serves as an index.
Client and Server-to-Server Tests
These XMPP hosts have various intentional problems or quirks that allow testing how your client or server implementation react in this case.
Client testing
To test a client, simply attempt to add any account there. No actual login should be possible, so username and password does not matter and should never be sent. If the client implementation gets to the point where it would normally authenticate then the test has completed. Whether this constitutes a success or a failure depends on the test.
Server testing
Testing a server implementation is done by having it attempt to establish a server-to-server connection. This could be done by sending a message or ping.
DNS problems
no-target.badxmpp.eu-
SRV record points to
NXDOMAIN. no-address.badxmpp.eu-
SRV record points to
NOERROR(only a TXT record, no A / AAAA). no-service.badxmpp.eu-
SRV record points to
'.', indicating no service. cname.badxmpp.eu- CNAME pointing at SRV pointing at CNAME.
Network and firewall
It’s dangerous to go alone, take this: RFC 8305.
ipv4-only.badxmpp.eu-
Only an
Arecord. ipv6-only.badxmpp.eu-
Only an
AAAArecord. drop.badxmpp.eu- SRV record points to a black hole.
reject.badxmpp.eu- SRV record points to blocked port.
ipv4-drop.badxmpp.eu- Port black-holed over IPv4, but not IPv6.
ipv4-reject.badxmpp.eu- Port blocked over IPv4, but not IPv6.
ipv6-drop.badxmpp.eu- Port black-holed over IPv6, but not IPv4.
ipv6-reject.badxmpp.eu- Port blocked over IPv4, but not IPv4.
http.badxmpp.eu- SRV record points to a port with a HTTP server.
https.badxmpp.eu- SRV record points to a port with a HTTPS server.
TLS compatibility levels
Based on Mozilla Server Side TLS recommendations.
TLS versions
RFC 8996 deprecates TLS 1.0 and 1.1.
tls1.badxmpp.eu- Supports only TLS 1.0.
tls11.badxmpp.eu- Supports only TLS 1.1.
tls12.badxmpp.eu- Supports only TLS 1.2.
tls13.badxmpp.eu- Supports only TLS 1.3.
Diffie-Hellman parameter sizes
Ephemeral Diffie-Hellman over a bit groups of varying sizes.
dh512.badxmpp.eu- 512-bit (forbidden) seems to be rejected by the server, does not work as intended.
dh1024.badxmpp.eu- 1024-bit (forbidden)
dh2048.badxmpp.eu- 2048-bit from RFC 7919
Certificate problems
See RFC 6125 for verification guidelines.
self-signed.badxmpp.eu- Has a self-signed certificate.
expired.badxmpp.eu- Expired certificate.
wrong-name.badxmpp.eu- Does not have a certificate matching the name.
missing-chain.badxmpp.eu- Certificate chain missing an intermediate certificate.
ecdsa.badxmpp.eu- ECDSA certificate, where others are RSA.
XMPP base connectivity
no-sasl.badxmpp.eu- Does not offer SASL.
no-tls.badxmpp.eu- Does not offer TLS.
fail-tls.badxmpp.eu-
Rejects
<starttls/>with<failure/> no-dialback.badxmpp.eu- Does not support Dialback. (Servers only)
bidi-only.badxmpp.eu- Requires XEP-0288
xmpps-only.badxmpp.eu- Supports only XMPP over TLS
xmpps-reject.badxmpp.eu- Rejects XMPP over TLS