Pentest & Bug Bounty Resources and Techniques
  • Pentest & Bug Bounty Resources and Techniques
    • Introduction
    • Tests Checklist
    • OSINT
    • Communications Security
      • SSL/TLS
    • Networking
      • Subdomains Discovery
        • DNS & OSINT
        • DNS Brute force
          • Second DNS Brute-Force Round
      • Subdomain Takeover
      • Network Host Scan/Discovery
        • External/Internal
        • Internal only
      • Network Vulnerability Scanning
      • Network Hacking
      • Parsing
      • Reporting
    • Brute Force
      • Wordlists
      • Databases
      • SSH
    • Web
      • Endpoint Discovery
      • Infrastructure & Configuration
        • Headers
        • WAF Detection/ Evasion
      • Injection
        • GraphQL
        • Cross-Site Scripting (XSS)
        • SQL Injection
        • Payloads
      • SSRF & XXE
        • Labs & Resources
        • Tools
        • SVG SSRF Cheatsheet
        • XXE - XEE - XML External Entity
      • JWT Vulnerabilities (Json Web Tokens)
      • HTTP/S DoS
    • Mobile
      • Both
        • SAST
          • MobSF
        • DAST
          • Installing Frida and Objection
      • Android
        • Create a Lab
          • Rooting Android Emulator
          • Rooting Android Emulator Cheat Sheet
        • APK Certificates
        • SAST
          • APKs
            • Get Information from APK
            • GDA (GJoy Dex Analysizer)
            • Scanning APK for URIs, endpoints & secrets
            • Google Maps API Scanner
        • DAST
          • Rooting the Android Studio AVDs
          • non-Rooted devices
            • Bypass SSL Pinning - non-rooted devices
              • Method 1: apk-mitm
              • Instrumentation with Frida and Objection
                • Bypass SSL Pinning - Method 2: With Objection Explore
                • Bypass SSL Pinning - Method 3: With root_bypass.js
          • Rooted Devices
            • Run frida-server in the emulator or device
            • Inject Frida
            • Bypass SSL Pinning - rooted devices
              • Install Burp CA as a system-level CA on the device
      • iOS
        • SAST
          • Building a reverse iOS engineering environment for free
          • Test Vulnerabilities
  • Lets Practice
    • Virtual Machines
    • Vulnerable App
    • Guided Labs
    • CTFs
  • Group 1
    • AI
Powered by GitBook
On this page
  • Audit SSL/TLS
  • SSLscan
  • TLSled
  • SSLyze
  • SSLlabs
  • SSLscan
  • TLSed
  • SSLyze
  • SSLlabs
  • HSTS
  • Nmap
  • Curl
  • POODLE
  • Nmap
  • SSL DROWN
  • HEARTBLEED
  • Get Certificates
  • Enum Ciphers
  • SSLv2
  • Sweet32
  1. Pentest & Bug Bounty Resources and Techniques
  2. Communications Security

SSL/TLS

Audit SSL/TLS

SSLscan

# Single Host
sslscan --show-ciphers --no-failed --show-certificate --xml=sslscan_out.xml <HOST>:<PORT>

# Target List
sslscan --show-ciphers --no-failed --show-certificate --xml=sslscan_out.xml --targets=targetlist.txt

One-line command:

# Single Host
domain=domain.com; sslscan --show-ciphers --no-failed --show-certificate --xml="${domain}".sslscan_out.xml "${domain}":<PORT>

TLSled

tlssled <IP> <PORT>

SSLyze

sslyze --http_headers --json_out=File.json <HOST>:<PORT>

One-line command:

domain=domain.com; sslyze --http_headers --regular --json_out="${domain}".json "${domain}":<PORT>

SSLlabs

SSLscan

# Single Host
sslscan --show-ciphers --no-failed --show-certificate --xml=sslscan_out.xml <HOST>:<PORT>

# Target List
sslscan --show-ciphers --no-failed --show-certificate --xml=sslscan_out.xml --targets=targetlist.txt

TLSed

tlssled <IP> <PORT>

SSLyze

sslyze --http_headers --regular --json_out=File.json <HOST>:<PORT>

SSLlabs

HSTS

Nmap

nmap -p 443 --script http-hsts-verify -Pn -v -oA http-hsts-verify <TARGET>

Curl

 curl -s -D- <TARGET> | grep -i strict-transport-security:

cURL should show a header like Strict-Transport-Security: max-age=15552000; preload

POODLE

Nmap

nmap -sV --version-light --script ssl-poodle -p <PORT> <TARGET>

More Info: http://nmap.org/nsedoc/scripts/ssl-poodle.html

SSL DROWN

nmap -sV --script=sslv2-drown -p 443 -Pn -v -oA sslv2-drown <TARGET>

HEARTBLEED

nmap --script ssl-heartbleed --script-args vulns.showall -oA ssl-heartbleed -Pn -p <PORT> -sV <TARGET>

More Info:

  • https://gist.github.com/bonsaiviking/10402038

  • http://nmap.org/nsedoc/scripts/ssl-heartbleed.html

Get Certificates

nmap -sV -sC -vv -oA certificadosSSL -Pn -p 443 <target>
openssl s_client -connect <TARGET>:<PORT>
echo | openssl s_client --showcerts --connect <target:port> | awk 'BEGIN{p="openssl x509 -noout -text"} {print |p} /-----END/{close(p)}'

More info: https://nmap.org/nsedoc/scripts/ssl-cert.html

Enum Ciphers

nmap --script ssl-enum-ciphers -Pn -p 443 -oA ssl-enum-ciphers <TARGET>

More Info: http://nmap.org/nsedoc/scripts/ssl-enum-ciphers.html

SSLv2

nmap -v -sV -sC <TARGET>
sslyze --sslv2 --json_out=output.json HOST:PORT

More info: https://nmap.org/nsedoc/scripts/sslv2.html

Sweet32

nmap --script ssl-enum-ciphers -p <PORT> <TARGET>
sudo docker pull adamcaudill/yawast && sudo docker run --rm adamcaudill/yawast scan https://www.domain.com --tdessessioncount

This is the recommended option, especially if you need to perform the SWEET32 test (--tdessessioncount), due to OpenSSL dropping support for the 3DES cipher suites.

In this case I’m using YAWAST to run a ssl scan, using the --tdessessioncount parameter to instruct YAWAST to perform the SWEET32 test. In this case, you can see that the TLS session was ended after 100 requests (Connection terminated after 100 requests (TLS Reconnected)) – which is a clear indication that the server isn’t vulnerable.

Had the server actually been vulnerable, this message would have been displayed:

[V] TLS Session Request Limit: Connection not terminated after 10,000 requests; possibly vulnerable to SWEET32

PreviousCommunications SecurityNextNetworking

Last updated 7 months ago

https://www.ssllabs.com/ssltest/index.html
https://www.ssllabs.com/ssltest/index.html