sslscan

Network Mapping -> Identify Live Hosts -> sslscan

SSLScan is a fast SSL port scanner. The tool connects to an SSL port, and determines what encryption is supported by the device, which is the preferred and prints the certificate.

           ___ ___| |___  ___ __ _ _ __
          / __/ __| / __|/ __/ _` | '_ \
          \__ \__ \ \__ \ (_| (_| | | | |
          |___/___/_|___/\___\__,_|_| |_|

                    Version 1.6
              http://www.titania.co.uk
     Copyright (C) 2007-2008 Ian Ventura-Whiting

SSLScan is a fast SSL port scanner. SSLScan connects to SSL
ports and determines what  ciphers are supported, which are
the servers  prefered  ciphers,  which  SSL  protocols  are
supported  and   returns  the   SSL   certificate.   Client
certificates /  private key can be configured and output is
to text / XML.

Command:
  sslscan [Options] [host:port | host]

Options:
  --targets=<file>     A file containing a list of hosts to
                       check.  Hosts can  be supplied  with
                       ports (i.e. host:port).
  --no-failed          List only accepted ciphers  (default
                       is to listing all ciphers).
  --ssl2               Only check SSLv2 ciphers.
  --ssl3               Only check SSLv3 ciphers.
  --tls1               Only check TLSv1 ciphers.
  --pk=<file>          A file containing the private key or
                       a PKCS#12  file containing a private
                       key/certificate pair (as produced by
                       MSIE and Netscape).
  --pkpass=<password>  The password for the private  key or
                       PKCS#12 file.
  --certs=<file>       A file containing PEM/ASN1 formatted
                       client certificates.
  --xml=<file>         Output results to an XML file.
  --version            Display the program version.
  --help               Display the  help text  you are  now
                       reading.
Example:
  sslscan 127.0.0.1

root@bt:~# sslscan --no-failed www.google.com
                   _
           ___ ___| |___  ___ __ _ _ __
          / __/ __| / __|/ __/ _` | '_ \
          \__ \__ \ \__ \ (_| (_| | | | |
          |___/___/_|___/\___\__,_|_| |_|

                    Version 1.6
              http://www.titania.co.uk
     Copyright (C) 2007-2008 Ian Ventura-Whiting

Testing SSL server www.google.com on port 443

  Supported Server Cipher(s):
    Accepted  SSLv3  256 bits  AES256-SHA
    Accepted  SSLv3  128 bits  AES128-SHA
    Accepted  SSLv3  168 bits  DES-CBC3-SHA
    Accepted  SSLv3  128 bits  RC4-SHA
    Accepted  SSLv3  128 bits  RC4-MD5
    Accepted  TLSv1  256 bits  AES256-SHA
    Accepted  TLSv1  128 bits  AES128-SHA
    Accepted  TLSv1  168 bits  DES-CBC3-SHA
    Accepted  TLSv1  128 bits  RC4-SHA
    Accepted  TLSv1  128 bits  RC4-MD5

  Prefered Server Cipher(s):
    SSLv3  128 bits  RC4-SHA
    TLSv1  128 bits  RC4-SHA

  SSL Certificate:
    Version: 2
    Serial Number: -4294967295
    Signature Algorithm: sha1WithRSAEncryption
    Issuer: /C=ZA/O=Thawte Consulting (Pty) Ltd./CN=Thawte SGC CA
    Not valid before: Dec 18 00:00:00 2009 GMT
    Not valid after: Dec 18 23:59:59 2011 GMT
    Subject: /C=US/ST=California/L=Mountain View/O=Google Inc/CN=www.google.com
    Public Key Algorithm: rsaEncryption
    RSA Public Key: (1024 bit)
      Modulus (1024 bit):
          00:e8:f9:86:0f:90:fa:86:d7:df:bd:72:26:b6:d7:
          44:02:83:78:73:d9:02:28:ef:88:45:39:fb:10:e8:
          7c:ae:a9:38:d5:75:c6:38:eb:0a:15:07:9b:83:e8:
          cd:82:d5:e3:f7:15:68:45:a1:0b:19:85:bc:e2:ef:
          84:e7:dd:f2:d7:b8:98:c2:a1:bb:b5:c1:51:df:d4:
          83:02:a7:3d:06:42:5b:e1:22:c3:de:6b:85:5f:1c:
          d6:da:4e:8b:d3:9b:ee:b9:67:22:2a:1d:11:ef:79:
          a4:b3:37:8a:f4:fe:18:fd:bc:f9:46:23:50:97:f3:
          ac:fc:24:46:2b:5c:3b:b7:45
      Exponent: 65537 (0x10001)
    X509v3 Extensions:
      X509v3 Basic Constraints: critical
        CA:FALSE
      X509v3 CRL Distribution Points:
        URI:http://crl.thawte.com/ThawteSGCCA.crl

      X509v3 Extended Key Usage:
        TLS Web Server Authentication, TLS Web Client Authentication, Netscape Server Gated Crypto
      Authority Information Access:
        OCSP - URI:http://ocsp.thawte.com
        CA Issuers - URI:http://www.thawte.com/repository/Thawte_SGC_CA.crt

  Verify Certificate:
    unable to get local issuer certificate