Copyright 2017 - Custom text here

User Rating: 0 / 5

Star InactiveStar InactiveStar InactiveStar InactiveStar Inactive
 

Today I was asked how can you verify if a WebServer is running TLS 1.2?

Using NMAP and with script SSL-ENUM-CIPHERS 

User Summary

This script repeatedly initiates SSLv3/TLS connections, each time trying a new cipher or compressor while recording whether a host accepts or rejects it. The end result is a list of all the ciphersuites and compressors that a server accepts.

Each ciphersuite is shown with a letter grade (A through F) indicating the strength of the connection. The grade is based on the cryptographic strength of the key exchange and of the stream cipher. The message integrity (hash) algorithm choice is not a factor. The output line beginning with Least strength shows the strength of the weakest cipher offered.

more...[https://nmap.org/nsedoc/scripts/ssl-enum-ciphers.html]

 

Example Usage

nmap -sV --script ssl-enum-ciphers -p 443 <host>

 

Script Output

PORT    STATE SERVICE REASON

443/tcp open  https   syn-ack

| ssl-enum-ciphers:

|   TLSv1.0:

|     ciphers:

|       TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA (secp256r1) - A

|       TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA (secp256r1) - A

|       TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (secp256r1) - A

|       TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (secp256r1) - A

|       TLS_RSA_WITH_AES_128_CBC_SHA (rsa 2048) - A

|       TLS_RSA_WITH_AES_256_CBC_SHA (rsa 2048) - A

|       TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA (secp256r1) - C

|       TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA (secp256r1) - C

|       TLS_RSA_WITH_3DES_EDE_CBC_SHA (rsa 2048) - C

|       TLS_ECDHE_ECDSA_WITH_RC4_128_SHA (secp256r1) - C

|       TLS_ECDHE_RSA_WITH_RC4_128_SHA (secp256r1) - C

|       TLS_RSA_WITH_RC4_128_SHA (rsa 2048) - C

|       TLS_RSA_WITH_RC4_128_MD5 (rsa 2048) - C

|     compressors:

|       NULL

|     cipher preference: server

|     warnings:

|       64-bit block cipher 3DES vulnerable to SWEET32 attack

|       Broken cipher RC4 is deprecated by RFC 7465

|       Ciphersuite uses MD5 for message integrity

|       Weak certificate signature: SHA1

|   TLSv1.2:

|     ciphers:

|       TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 (secp256r1) - A

|       TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 (secp256r1) - A

|       TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA (secp256r1) - A

|       TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA (secp256r1) - A

|       TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (secp256r1) - A

|       TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (secp256r1) - A

|       TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (secp256r1) - A

|       TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (secp256r1) - A

|       TLS_RSA_WITH_AES_128_GCM_SHA256 (rsa 2048) - A

|       TLS_RSA_WITH_AES_256_GCM_SHA384 (rsa 2048) - A

|       TLS_RSA_WITH_AES_128_CBC_SHA (rsa 2048) - A

|       TLS_RSA_WITH_AES_256_CBC_SHA (rsa 2048) - A

|       TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA (secp256r1) - C

|       TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA (secp256r1) - C

|       TLS_RSA_WITH_3DES_EDE_CBC_SHA (rsa 2048) - C

|       TLS_ECDHE_ECDSA_WITH_RC4_128_SHA (secp256r1) - C

|       TLS_ECDHE_RSA_WITH_RC4_128_SHA (secp256r1) - C

|       TLS_RSA_WITH_RC4_128_SHA (rsa 2048) - C

|       TLS_RSA_WITH_RC4_128_MD5 (rsa 2048) - C

|     compressors:

|       NULL

|     cipher preference: server

|     warnings:

|       64-bit block cipher 3DES vulnerable to SWEET32 attack

|       Broken cipher RC4 is deprecated by RFC 7465

|       Ciphersuite uses MD5 for message integrity

|_  least strength: C

 

 

 

0
0
0
s2sdefault
Create a website with how to start blogging

Search

f t g