{"id":4358,"date":"2016-12-10T17:58:17","date_gmt":"2016-12-10T09:58:17","guid":{"rendered":"https:\/\/www.darknet.org.uk\/?p=4358"},"modified":"2017-11-11T16:52:18","modified_gmt":"2017-11-11T08:52:18","slug":"sslscan-detect-ssl-versions-cipher-suites-including-tls","status":"publish","type":"post","link":"https:\/\/www.darknet.org.uk\/2016\/12\/sslscan-detect-ssl-versions-cipher-suites-including-tls\/","title":{"rendered":"sslscan Download &#8211; Detect SSL Versions &#038; Cipher Suites (Including TLS)"},"content":{"rendered":"<p>sslscan is a very efficient C program that allows you to detect SSL versions &#038; cipher suites (including TLS version checker) and also checks for vulnerabilities like Heartbleed and POODLE.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/www.darknet.org.uk\/wp-content\/uploads\/2016\/12\/sslscan-Detect-SSL-TLS-Cipher-Suites-594x640.png\" alt=\"sslscan - Detect SSL Versions &#038; Cipher Suites (Including TLS)\" width=\"594\" height=\"640\" class=\"aligncenter size-medium wp-image-4363\" srcset=\"https:\/\/www.darknet.org.uk\/wp-content\/uploads\/2016\/12\/sslscan-Detect-SSL-TLS-Cipher-Suites-594x640.png 594w, https:\/\/www.darknet.org.uk\/wp-content\/uploads\/2016\/12\/sslscan-Detect-SSL-TLS-Cipher-Suites.png 600w\" sizes=\"(max-width: 594px) 100vw, 594px\" \/><\/p>\n<script async src=\"https:\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-3033787195489589\"\r\n     crossorigin=\"anonymous\"><\/script>\r\n<!-- Darknet Responsive Post Ad Links [previously link ad unit] -->\r\n<ins class=\"adsbygoogle\"\r\n     style=\"display:block\"\r\n     data-ad-client=\"ca-pub-3033787195489589\"\r\n     data-ad-slot=\"5456620019\"\r\n     data-ad-format=\"auto\"><\/ins>\r\n<script>\r\n     (adsbygoogle = window.adsbygoogle || []).push({});\r\n<\/script>\n<p>A useful tool to keep around after you&#8217;ve set-up a server to check the SSL configuration is robust. Especially if you&#8217;re in an Internet limited environment and you can&#8217;t use an Online tool like the excellent Qualsys SSL Labs &#8211; <a href=\"https:\/\/www.ssllabs.com\/ssltest\/\">https:\/\/www.ssllabs.com\/ssltest\/<\/a><\/p>\n<h2>sslscan Features &#8211; TLS Version Checker<\/h2>\n<p>sslscan has fairly complete support to detect all versions and ciphers for both SSL and TLS, including vulnerabilities (like Heartbleed and Poodle).<\/p>\n<ul>\n<li>Highlight SSLv2 and SSLv3 ciphers in output.<\/li>\n<li>Highlight CBC ciphers on SSLv3 (POODLE).<\/li>\n<li>Highlight 3DES and RC4 ciphers in output.<\/li>\n<li>Highlight PFS+GCM ciphers as good in output.<\/li>\n<li>Check for OpenSSL HeartBleed (CVE-2014-0160).<\/li>\n<li>Flag expired certificates.<\/li>\n<li>Flag weak DHE keys with OpenSSL >= 1.0.2.<\/li>\n<li>Experimental Windows &#038; OS X support.<\/li>\n<li>Support for scanning PostgreSQL servers.<\/li>\n<li>StartTLS support for LDAP.<\/li>\n<\/ul>\n<h3>ssl scan Command Usage<\/h3>\n<script async src=\"https:\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-3033787195489589\"\r\n     crossorigin=\"anonymous\"><\/script>\r\n<!-- Darknet Responsive Post Ad Links [previously link ad unit] -->\r\n<ins class=\"adsbygoogle\"\r\n     style=\"display:block\"\r\n     data-ad-client=\"ca-pub-3033787195489589\"\r\n     data-ad-slot=\"5456620019\"\r\n     data-ad-format=\"auto\"><\/ins>\r\n<script>\r\n     (adsbygoogle = window.adsbygoogle || []).push({});\r\n<\/script>\n<pre>Command:\r\n[Options] [host:port | host]\r\n\r\nOptions:\r\n--targets=<file>       A file containing a list of hosts to check.\r\n\t\t       Hosts can  be supplied  with ports (host:port)\r\n--sni-name=<name>      Hostname for SNI\r\n--ipv4                 Only use IPv4\r\n--ipv6                 Only use IPv6\r\n--show-certificate     Show full certificate information\r\n--no-check-certificate    Don't warn about weak certificate algorithm or keys\r\n--show-client-cas      Show trusted CAs for TLS client auth\r\n--show-ciphers         Show supported client ciphers\r\n--show-cipher-ids      Show cipher ids\r\n--show-times           Show handhake times in milliseconds\r\n--ssl2                 Only check SSLv2 ciphers\r\n--ssl3                 Only check SSLv3 ciphers\r\n--tls10                Only check TLSv1.0 ciphers\r\n--tls11                Only check TLSv1.1 ciphers\r\n--tls12                Only check TLSv1.2 ciphers\r\n--tlsall               Only check TLS ciphers (all versions)\r\n--ocsp                 Request OCSP response from server\r\n--pk=<file>            A file containing the private key or a PKCS#12 file\r\n                       containing a private key\/certificate pair\r\n--pkpass=<password>    The password for the private  key or PKCS#12 file\r\n--certs=<file>         A file containing PEM\/ASN1 formatted client certificates\r\n--no-ciphersuites      Do not check for supported ciphersuites\r\n--no-fallback          Do not check for TLS Fallback SCSV\r\n--no-renegotiation     Do not check for TLS renegotiation\r\n--no-compression       Do not check for TLS compression (CRIME)\r\n--no-heartbleed        Do not check for OpenSSL Heartbleed (CVE-2014-0160)\r\n--starttls-ftp         STARTTLS setup for FTP\r\n--starttls-imap        STARTTLS setup for IMAP\r\n--starttls-irc         STARTTLS setup for IRC\r\n--starttls-ldap        STARTTLS setup for LDAP\r\n--starttls-pop3        STARTTLS setup for POP3\r\n--starttls-smtp        STARTTLS setup for SMTP\r\n--starttls-xmpp        STARTTLS setup for XMPP\r\n--starttls-psql        STARTTLS setup for PostgreSQL\r\n--xmpp-server          Use a server-to-server XMPP handshake\r\n--http                 Test a HTTP connection\r\n--rdp                  Send RDP preamble before starting scan\r\n--bugs                 Enable SSL implementation bug work-arounds\r\n--timeout=<sec>        Set socket timeout. Default is 3s\r\n--sleep=<msec>         Pause between connection request. Default is disabled\r\n--xml=<file>           Output results to an XML file\r\n                       <file> can be -, which means stdout\r\n--version              Display the program version\r\n--verbose              Display verbose output\r\n--no-cipher-details    Disable EC curve names and EDH\/RSA key lengths output\r\n--no-colour            Disable coloured output\r\n--help                 Display the  help text  you are  now reading<\/pre>\n<p>You can download sslscan cipher detector here:<\/p>\n<p><a href=\"https:\/\/github.com\/rbsec\/sslscan\/archive\/1.11.0-rbsec.tar.gz\">sslscan-1.11.0-rbsec.tar.gz<\/a><\/p>\n<p>Or read more <a href=\"https:\/\/github.com\/rbsec\/sslscan\">here<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>sslscan is a very efficient C program that allows you to detect SSL versions &#038; cipher suites (including TLS version checker) and also checks for vulnerabilities like Heartbleed and POODLE. A useful tool to keep around after you&#8217;ve set-up a server to check the SSL configuration is robust. Especially if you&#8217;re in an Internet limited [&hellip;]<\/p>\n","protected":false},"author":25,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_seopress_robots_primary_cat":"","_seopress_titles_title":"","_seopress_titles_desc":"sslscan is a C program that allows you to detect SSL versions & cipher suites (including TLS) & also checks for vulnerabilities like Heartbleed.","_seopress_robots_index":"","_genesis_hide_title":false,"_genesis_hide_breadcrumbs":false,"_genesis_hide_singular_image":false,"_genesis_hide_footer_widgets":false,"_genesis_custom_body_class":"","_genesis_custom_post_class":"","_genesis_layout":"","footnotes":""},"categories":[9],"tags":[4280,8693],"featured_image_src":null,"featured_image_src_square":null,"author_info":{"display_name":"Darknet","author_link":"https:\/\/www.darknet.org.uk\/author\/darknet\/"},"_links":{"self":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts\/4358"}],"collection":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/users\/25"}],"replies":[{"embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/comments?post=4358"}],"version-history":[{"count":0,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts\/4358\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/media?parent=4358"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/categories?post=4358"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/tags?post=4358"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}