sslscan: tests SSL/TLS enabled services to discover supported cipher suites

by ddos · October 31, 2024

sslscan

sslscan tests SSL/TLS-enabled services to discover supported cipher suites. This is a fork of ioerror’s version of sslscan. Changes are as follows:

Highlight SSLv2 and SSLv3 ciphers in output.
Highlight CBC ciphers on SSLv3 (POODLE).
Highlight 3DES and RC4 ciphers in output.
Highlight PFS+GCM ciphers as good in output.
Highlight NULL (0 bit), weak (<40 bit) and medium (40 < n <= 56) ciphers in output.
Highlight anonymous (ADH and AECDH) ciphers in output (purple).
Hide certificate information by default (display with --get-certificate).
Hide rejected ciphers by default (display with --failed).
Added TLSv1.1 and TLSv1.2 support (merged from twwbond/sslscan).
Compiles if OpenSSL does not support SSLv2 ciphers (merged from digineo/sslscan).
Supports IPv6 hostnames (can be forced with --ipv6).
Check for TLS compression (CRIME, disable with --no-compression).
Disable cipher suite checking --no-ciphersuites.
Disable coloured output --no-colour.
Removed undocumented -p output option.
Added check for OpenSSL HeartBleed (CVE-2014-0160, disable with --no-heartbleed).
Flag certificates signed with MD5 or SHA-1, or with short (<2048 bit) RSA keys.
Support scanning RDP servers with --rdp (credit skettler).
Added option to specify socket timeout.
Added option for static compilation (credit dmke).
Added --sleep option to pause between requests.
Disable output for anything than specified checks --no-preferred.
Determine the list of CAs acceptable for client certificates --show-client-cas.
Experimental build support on OSX (credit MikeSchroll).
Flag some self-signed SSL certificates.
Experimental Windows support (credit jtesta).
Display EC curve names and DHE key lengths with OpenSSL >= 1.0.2 --no-cipher-details.
Flag weak DHE keys with OpenSSL >= 1.0.2 --cipher-details.
Flag expired certificates.
Flag TLSv1.0 ciphers in output as weak.
Experimental OSX support (static building only).
Support for scanning PostgreSQL servers (credit nuxi).
Check for TLS Fallback SCSV support.
Added StartTLS support for LDAP --starttls-ldap.
Added SNI support --sni-name (credit Ken).
Support STARTTLS for MySQL (credit bk2017).

Installation

Windows
Pre-build cross-compiled Windows binaries are available here.
Linux
apt-get install build-essential git zlib1g-dev
apt-get build-dep openssl
git clone https://github.com/rbsec/sslscan.git
cd sslscan
make
make install

Use

Source: https://github.com/rbsec/

Support Our Threat Intelligence

If you find our technology report and cybersecurity news helpful, consider supporting our work.

Buy Me a Coffee PayPal