search

opnsense / tools

OPNsense release engineering toolkit
https://opnsense.org/
BSD 2-Clause "Simplified" License
260 stars 187 forks source link

sslscan Fast SSL port scanner #390

Closed ronin3510 closed 6 months ago

ronin3510 commented 6 months ago

Hi there,

sslscan is a neat and lightweight troubleshooting tool that would be great to have available in OPNsense -both CE and BE- allowing for the gathering of information directly from the FW without having to open unnecessary ports from the management vlan(s).

The sample output seen below is also color coded which improves readability, alas this is not visible in Github.

freshports

Github homepage

root@fbsd:~ # pkg info sslscan sslscan-2.0.16 Name : sslscan Version : 2.0.16 Installed on : Thu Nov 30 22:15:52 2023 UTC Origin : security/sslscan Architecture : FreeBSD:14:amd64 Prefix : /usr/local Categories : security Licenses : GPLv3 Maintainer : gavin@FreeBSD.org WWW : https://github.com/rbsec/sslscan/ Comment : Fast SSL port scanner Annotations : FreeBSD_version: 1400097 build_timestamp: 2023-11-18T13:18:59+0000 built_by : poudriere-git-3.3.0-1258-gbc38e2e6 port_checkout_unclean: no port_git_hash : 157c391cc1 ports_top_checkout_unclean: no ports_top_git_hash: 8a036a08da repo_type : binary repository : FreeBSD Flat size : 5.25MiB Description : SSLScan is a fast SSL port scanner. SSLScan connects to SSL ports and determines what ciphers are supported, which are the servers prefered ciphers, which SSL protocols are supported and returns the SSL certificate. Client certificates and private key can be configured and output is to text / XML. root@fbsd:~ # root@fbsd:~ # root@fbsd:~ # sslscan expired.badssl.com Version: 2.0.16-static OpenSSL 3.1.0 14 Mar 2023

Connected to 104.154.89.105

Testing SSL server expired.badssl.com on port 443 using SNI name expired.badssl.com

SSL/TLS Protocols: SSLv2 disabled SSLv3 disabled TLSv1.0 enabled TLSv1.1 enabled TLSv1.2 enabled TLSv1.3 disabled

TLS Fallback SCSV: Server supports TLS Fallback SCSV

TLS renegotiation: Secure session renegotiation supported

TLS Compression: Compression disabled

Heartbleed: TLSv1.2 not vulnerable to heartbleed TLSv1.1 not vulnerable to heartbleed TLSv1.0 not vulnerable to heartbleed

Supported Server Cipher(s): Preferred TLSv1.2 128 bits ECDHE-RSA-AES128-GCM-SHA256 Curve P-256 DHE 256 Accepted TLSv1.2 256 bits ECDHE-RSA-AES256-GCM-SHA384 Curve P-256 DHE 256 Accepted TLSv1.2 128 bits DHE-RSA-AES128-GCM-SHA256 DHE 2048 bits Accepted TLSv1.2 256 bits DHE-RSA-AES256-GCM-SHA384 DHE 2048 bits Accepted TLSv1.2 128 bits ECDHE-RSA-AES128-SHA256 Curve P-256 DHE 256 Accepted TLSv1.2 128 bits ECDHE-RSA-AES128-SHA Curve P-256 DHE 256 Accepted TLSv1.2 256 bits ECDHE-RSA-AES256-SHA384 Curve P-256 DHE 256 Accepted TLSv1.2 256 bits ECDHE-RSA-AES256-SHA Curve P-256 DHE 256 Accepted TLSv1.2 128 bits DHE-RSA-AES128-SHA256 DHE 2048 bits Accepted TLSv1.2 128 bits DHE-RSA-AES128-SHA DHE 2048 bits Accepted TLSv1.2 256 bits DHE-RSA-AES256-SHA256 DHE 2048 bits Accepted TLSv1.2 256 bits DHE-RSA-AES256-SHA DHE 2048 bits Accepted TLSv1.2 112 bits ECDHE-RSA-DES-CBC3-SHA Curve P-256 DHE 256 Accepted TLSv1.2 128 bits AES128-GCM-SHA256 Accepted TLSv1.2 256 bits AES256-GCM-SHA384 Accepted TLSv1.2 128 bits AES128-SHA256 Accepted TLSv1.2 256 bits AES256-SHA256 Accepted TLSv1.2 128 bits AES128-SHA Accepted TLSv1.2 256 bits AES256-SHA Accepted TLSv1.2 112 bits DES-CBC3-SHA Accepted TLSv1.2 256 bits DHE-RSA-CAMELLIA256-SHA DHE 2048 bits Accepted TLSv1.2 256 bits CAMELLIA256-SHA Accepted TLSv1.2 128 bits DHE-RSA-CAMELLIA128-SHA DHE 2048 bits Accepted TLSv1.2 128 bits CAMELLIA128-SHA Preferred TLSv1.1 128 bits ECDHE-RSA-AES128-SHA Curve P-256 DHE 256 Accepted TLSv1.1 256 bits ECDHE-RSA-AES256-SHA Curve P-256 DHE 256 Accepted TLSv1.1 128 bits DHE-RSA-AES128-SHA DHE 2048 bits Accepted TLSv1.1 256 bits DHE-RSA-AES256-SHA DHE 2048 bits Accepted TLSv1.1 112 bits ECDHE-RSA-DES-CBC3-SHA Curve P-256 DHE 256 Accepted TLSv1.1 128 bits AES128-SHA Accepted TLSv1.1 256 bits AES256-SHA Accepted TLSv1.1 112 bits DES-CBC3-SHA Accepted TLSv1.1 256 bits DHE-RSA-CAMELLIA256-SHA DHE 2048 bits Accepted TLSv1.1 256 bits CAMELLIA256-SHA Accepted TLSv1.1 128 bits DHE-RSA-CAMELLIA128-SHA DHE 2048 bits Accepted TLSv1.1 128 bits CAMELLIA128-SHA Preferred TLSv1.0 128 bits ECDHE-RSA-AES128-SHA Curve P-256 DHE 256 Accepted TLSv1.0 256 bits ECDHE-RSA-AES256-SHA Curve P-256 DHE 256 Accepted TLSv1.0 128 bits DHE-RSA-AES128-SHA DHE 2048 bits Accepted TLSv1.0 256 bits DHE-RSA-AES256-SHA DHE 2048 bits Accepted TLSv1.0 112 bits ECDHE-RSA-DES-CBC3-SHA Curve P-256 DHE 256 Accepted TLSv1.0 128 bits AES128-SHA Accepted TLSv1.0 256 bits AES256-SHA Accepted TLSv1.0 112 bits DES-CBC3-SHA Accepted TLSv1.0 256 bits DHE-RSA-CAMELLIA256-SHA DHE 2048 bits Accepted TLSv1.0 256 bits CAMELLIA256-SHA Accepted TLSv1.0 128 bits DHE-RSA-CAMELLIA128-SHA DHE 2048 bits Accepted TLSv1.0 128 bits CAMELLIA128-SHA

Server Key Exchange Group(s): TLSv1.2 128 bits secp256r1 (NIST P-256)

SSL Certificate: Signature Algorithm: sha256WithRSAEncryption RSA Key Strength: 2048

Subject: .badssl.com Altnames: DNS:.badssl.com, DNS:badssl.com Issuer: COMODO RSA Domain Validation Secure Server CA

Not valid before: Apr 9 00:00:00 2015 GMT Not valid after: Apr 12 23:59:59 2015 GMT`

Thank you.