SSLScan

Vulnerability Analysis

Beginnerlow risk

SSLScan queries SSL/TLS services (such as HTTPS) to determine supported ciphers, key exchanges, and security flaws like Heartbleed or broken protocol configurations.

Installation

sudo apt install sslscan

Basic Syntax

sslscan <target_host_or_ip>

Quick Facts

Full Name

SSLScan Scanner

License

V2 OpenSSL License

Language

C

Protocol

SSL/TLS

Category

SSL/TLS Scanner

Speed

Fast

Tool Overview

SSLScan is a fast SSL/TLS scanner that queries services to determine supported cipher suites, key exchanges, certificate details, and security vulnerabilities like Heartbleed and POODLE.

The tool provides clear, color-coded output showing protocol versions, cipher strengths, and certificate information. It supports batch scanning of multiple targets and JSON output for automation.

SSLScan is widely used for quick SSL/TLS security checks, certificate validation, and identifying weak cipher configurations. It is faster but less comprehensive than testssl.sh.

Common Commands

sslscan 192.168.1.1Cipher check - Enumerate all accepted cryptographic protocols and cipher variations on target

sslscan example.comBasic SSL scan

sslscan --no-colour example.comPlain output

sslscan --show-certificate example.comShow certificate

sslscan --targets=hosts.txtMultiple targets

sslscan example.comBasic SSL/TLS scan

sslscan --show-certificate example.comShow full certificate details

sslscan --no-colour example.comNo color output for piping

sslscan --xml=results.xml example.comXML output for tool integration

sslscan --json=results.json example.comJSON output

sslscan --targets-file=targets.txtScan multiple targets from file

sslscan --ipv4 example.comForce IPv4 connection

sslscan --ipv6 example.comForce IPv6 connection

sslscan --starttls-ftp example.comScan FTP with STARTTLS

sslscan --starttls-smtp example.comScan SMTP with STARTTLS

Step-by-Step Guide

1Execute sslscan pointing at the target domain or IP
2Evaluate the list of enabled TLS and SSL protocol versions
3Identify any deprecated or weak cryptographic ciphers in the list
4Check the output for recognized vulnerabilities like POODLE or Heartbleed
5Examine the certificate details for expiration or mismatch errors

Use Cases

Cipher Enumeration

Discover supported cipher suites and key exchanges.

Certificate Analysis

Check certificate details, expiry, and chain.

Vulnerability Detection

Detect Heartbleed, POODLE, and other SSL flaws.

Protocol Testing

Identify supported SSL/TLS protocol versions.

Key Features

Cipher Enumeration: List all supported cipher suites.
Protocol Detection: Identify SSL/TLS protocol versions.
Certificate Analysis: Show certificate details and chain.
Vulnerability Checks: Detect Heartbleed, POODLE, and more.
Batch Scanning: Scan multiple targets from file.

Related Tools

testssl.sh

Vulnerability Analysis

Comprehensive SSL/TLS vulnerability scanner.

Nmap

Information Gathering

Network port scanner.

Frequently Asked Questions

What is SSLScan used for?

SSLScan is used for scanning SSL/TLS services to determine supported ciphers, key exchanges, protocol versions, and certificate details. It identifies weak configurations and known vulnerabilities.

How does SSLScan differ from testssl?

SSLScan is faster and simpler for quick checks. testssl provides more comprehensive vulnerability testing including protocol downgrade attacks and specific CVE checks.

Can SSLScan detect Heartbleed?

Yes, SSLScan can detect the Heartbleed vulnerability (CVE-2014-0160) and other SSL/TLS vulnerabilities like POODLE and BEAST.

Does SSLScan work with HTTPS?

Yes, SSLScan works with any SSL/TLS service including HTTPS, FTPS, IMAPS, and other encrypted protocols.

How do I install SSLScan?

Install SSLScan using: sudo apt install sslscan on Kali Linux. On other systems, compile from source or use your package manager.

How do I use SSLScan for a basic scan?

Run sslscan example.com to scan a target. Use --show-certificate to see certificate details and --no-colour for plain output.

What are the most common SSLScan commands?

Common commands include: sslscan target (basic scan), sslscan --show-certificate target (show cert), sslscan --targets=hosts.txt (multiple targets).

How do I check certificate details with SSLScan?

Use sslscan --show-certificate target to see certificate issuer, expiry, chain, and other details.

Is SSLScan legal to use?

SSLScan itself is legal software. However, scanning services without permission from the owner may violate laws. Always obtain written authorization before testing.

What SSL/TLS vulnerabilities can SSLScan detect?

SSLScan detects Heartbleed, POODLE, BEAST, FREAK, Logjam, and other SSL/TLS vulnerabilities. It also identifies weak ciphers and deprecated protocols.

How do I scan multiple targets with SSLScan?

Use --targets=hosts.txt to scan multiple targets from a file, one host per line.

What is the -p flag in SSLScan?

The -p flag specifies the port to scan. Default is 443. Use -p 8443 for non-standard HTTPS ports.

How do I save SSLScan results?

Use --output=file.txt to save results to a file. SSLScan also supports XML output for integration with other tools.

How does SSLScan compare to Nmap SSL scripts?

SSLScan is faster and focused specifically on SSL/TLS. Nmap's SSL scripts provide broader coverage but are slower. Use SSLScan for quick SSL checks; Nmap for comprehensive scanning.

What does SSLScan output show?

SSLScan output shows supported protocols, cipher suites with strength ratings, key exchange algorithms, certificate details, and detected vulnerabilities.

How long does an SSLScan scan take?

A basic SSLScan scan completes in 5-15 seconds. Scans with certificate details take slightly longer but still finish quickly.

What is the --no-colour flag in SSLScan?

The --no-colour flag disables color output, making it easier to pipe results to files or other tools without ANSI color codes.

How do I check for weak ciphers with SSLScan?

SSLScan automatically identifies weak ciphers and marks them with color coding. Red indicates weak/deprecated ciphers; green indicates strong ciphers.