SSLSCAN(1)

📦
version 2.2.3 · 5 versions
, in arch rolling, nixpkgs unstable

💅 sslscan — the manual, but make it make sense

okay bestie, welcome to the sslscan page from your General Commands Manual (yes that's the manual name, we're fancy here) ✨

🌸 NAME

sslscan — a fast SSL/TLS scanner 🦋

✨ SYNOPSIS

sslscan [options] [host:port | host]

🎀 DESCRIPTION

so basically sslscan goes and queries SSL/TLS services (think HTTPS, obviously) and then reports back on all the juicy stuff: protocol versions, cipher suites, key exchanges, signature algorithms, and the certificates in use 💖 The whole point is helping you understand which of those parameters are weak from a security standpoint — like, vibe check the server, but for crypto 🔥 It can also dump results into an XML file so external programs can gobble them up easily.

The terminal output is colour-coded, and here's the legend, no cap:

  • Red Background — NULL ciphers (no encryption at all 🙈) or anonymous ciphers (no verification of peer)
  • Red — ciphers and algorithms with demonstrated vulnerabilities, or ones that are generally considered untrusted 💀
  • Yellow — ciphers and algorithms with known weaknesses, or that are still too new to be widely trusted, but that are not generally considered exploitable (even by the standards of TLS vulnerabilities). like, side-eye but not panic 🫶
  • Green — ciphers and algorithms aligned with current recommended best practices 👑 slay

💜 OPTIONS

  • --help — shows a summary of the options
  • --targets=<file> — a file containing a list of hosts to check. Hosts can be supplied with ports (i.e. host:port). One target per line 🍓
  • --sni-name=<name> — use a different hostname for SNI
  • --ipv4, -4 — force IPv4 DNS resolution. Default is to try IPv4, and if that fails then fall back to IPv6
  • --ipv6, -6 — force IPv6 DNS resolution. Default is to try IPv4, and if that fails then fall back to IPv6
  • --show-certificate — display certificate information
  • --show-certificates — display the full certificate chain ⛓️
  • --no-check-certificate — don't flag certificates signed with weak algorithms (MD5 and SHA-1) or short (<2048 bit) RSA keys
  • --show-client-cas — show a list of CAs that the server allows for client authentication. Will be blank for IIS/Schannel servers (iykyk)
  • --show-ciphers — show a complete list of ciphers supported by sslscan
  • --show-cipher-ids — print the hexadecimal cipher IDs
  • --iana-names — use IANA/RFC cipher names rather than OpenSSL ones
  • --show-times — show the time taken for each handshake in milliseconds. ⚠️ note that only a single request is made with each cipher, and that the size of the ClientHello is not constant, so this should not be used for proper benchmarking or performance testing. You might want to also use --no-cipher-details to make the output a bit clearer
  • --ssl2 — only check if SSLv2 is enabled (yes, the ancient one 💀)
  • --ssl3 — only check if SSLv3 is enabled
  • --tls10 — only check TLS 1.0 ciphers
  • --tls11 — only check TLS 1.1 ciphers
  • --tls12 — only check TLS 1.2 ciphers
  • --tls13 — only check TLS 1.3 ciphers
  • --tlsall — only check TLS ciphers (versions 1.0, 1.1, 1.2, and 1.3) 🌈
  • --ocsp — display OCSP status
  • --pk=<file> — a file containing the private key, or a PKCS#12 file containing a private key/certificate pair (as produced by MSIE and Netscape)
  • --pkpass=<password> — the password for the private key or PKCS#12 file 🔐
  • --certs=<file> — a file containing PEM/ASN1 formatted client certificates
  • --no-ciphersuites — do not scan for supported ciphersuites
  • --no-fallback — do not check for TLS Fallback Signaling Cipher Suite Value (fallback)
  • --no-renegotiation — do not check for secure TLS renegotiation
  • --no-compression — do not check for TLS compression (CRIME)
  • --no-heartbleed — do not check for OpenSSL Heartbleed (CVE-2014-0160) 🩸 iconic CVE, terrible bug
  • --no-groups — do not enumerate key exchange groups
  • --all-groups — enumerate key exchange groups for all supported TLS versions, not just the highest among TLS 1.0, 1.1, and 1.2. Use when auditing servers that may have different group policies per protocol version 👀
  • --show-sigs — enumerate signature algorithms
  • --starttls-ftp — STARTTLS setup for FTP
  • --starttls-imap — STARTTLS setup for IMAP
  • --starttls-irc — STARTTLS setup for IRC
  • --starttls-ldap — STARTTLS setup for LDAP
  • --starttls-pop3 — STARTTLS setup for POP3
  • --starttls-smtp — STARTTLS setup for SMTP
  • --starttls-mysql — STARTTLS setup for MySQL
  • --starttls-xmpp — STARTTLS setup for XMPP
  • --starttls-psql — STARTTLS setup for PostgreSQL
  • --xmpp-server — perform a server-to-server XMPP connection. Try this if --starttls-xmpp is failing 🫠
  • --rdp — send RDP preamble before starting scan
  • --bugs — enables workarounds for SSL bugs
  • --timeout=<sec> — set socket timeout. Useful for hosts that fail to respond to ciphers they don't understand. Default is 3s ⏰
  • --connect-timeout=<sec> — set initial connection timeout. Useful for hosts that are slow to respond to the initial connect(). Default is 75s 🐢
  • --sleep=<msec> — pause between connections. Useful on STARTTLS SMTP services, or anything else that's performing rate limiting. Default is disabled 😴
  • --xml=<file> — output results to an XML file. - can be used to mean stdout 🍓
  • --version — show version of program
  • --verbose — display verbose output
  • --no-cipher-details — hide NIST EC curve name and EDH/RSA key length
  • --no-colour — disable coloured output (if your terminal is doing too much 💅)

🦋 EXAMPLES

Scan a local HTTPS server:

sslscan localhost
sslscan 127.0.0.1
sslscan 127.0.0.1:443
sslscan [::1]
sslscan [::1]:443

look at you go, scanning your own localhost like a responsible little icon 👑

🧚 AUTHOR

sslscan was originally written by Ian Ventura-Whiting <fizz@titania.co.uk>. sslscan was extended by Jacob Appelbaum <jacob@appelbaum.net>. sslscan was extended by rbsec <robin@rbsec.net>. This manual page was originally written by Marvin Stark <marv@der-marv.de>.

okay that's the whole thing bestie, go forth and scan responsibly 💖✨🎀

sign-off time: this page came from the General Commands Manual, dated March 19, 2020 — so if the crypto landscape moved since then, that's between you and the calendar 🦋 no cap, stay safe out there 🫶
📦 where this page comes from