SSLScan- Free SSL-based Tool

SSLScan determines what ciphers are supported on SSL-based services, such as HTTPS. Furthermore, SSLScan will determine the prefered ciphers of the SSL service.

For details about how to download this free tool go to www.titania-security.com/labs/sslscan

Requirements

SSLScan requires the GNU C compiler and the OpenSSL library. Both of these are usually installed by default on a number of Linux distributions. Although this program has not been tested on other platforms it should work if the requirements have been met.

Building

To build SSLScan, first extract the archive and change into the source directory. Then execute the following command:

gcc -lssl -o sslscan sslscan.c

On Apple Mac OS X you will need to install the ports version of OpenSSL as the version that comes with your Mac is missing a few things. So if you don't already have ports installed, download it from www.macports.org. You can install the latest OpenSSL using the following command:

sudo port install openssl

SSL Scan can then be built using the following command:

gcc -I/opt/local/include -L/opt/local/lib -lssl -lcrypto -o sslscan sslscan.c

Running

In its simplist form, SSLScan can be run with only one parameter, just specify the host to test. SSLScan will default to port 443 if a port is not specified.

The command line arguements for SSLScan are:

Command:
  sslscan [Options] [host:port | host]

Options:
  --targets=           A file containing a list of hosts to
                       check.  Hosts can  be supplied  with
                       ports (i.e. host:port).
  --no-failed          List only accepted ciphers  (default
                       is to listing all ciphers).
  --ssl2               Only check SSLv2 ciphers.
  --ssl3               Only check SSLv3 ciphers.
  --tls1               Only check TLSv1 ciphers.
  --pk=                A file containing the private key or
                       a PKCS#12  file containing a private
                       key/certificate pair (as produced by
                       MSIE and Netscape).
  --pkpass=            The password for the private  key or
                       PKCS#12 file.
  --certs=             A file containing PEM/ASN1 formatted
                       client certificates.
  --starttls           If a STARTTLS is required to kick an
                       SMTP service into action.
  --http               Test a HTTP connection.
  --bugs               Enable SSL implementation  bug work-
                       arounds.
  --xml=               Output results to an XML file.
  --version            Display the program version.
  --help               Display the  help text  you are  now

Third Party

Jabra has developed an XML parser for SSLScan which can be downloaded from http://search.cpan.org/~jabra/.

Changes

Version: 1.8.2
Date   : 19/06/2009
Author : Ian Ventura-Whiting (Fizz)
Changes: The following are a list of changes
         since the previous version:
            > Fixed output with HTML disabled
            > Fixed XML critical

Version: 1.8.1
Date   : 25/05/2009
Author : Ian Ventura-Whiting (Fizz)
Changes: The following are a list of changes
         since the previous version:
            > Fixed some compiler warnings.

Version: 1.8.0
Date   : 19/05/2009
Author : Ian Ventura-Whiting (Fizz)
Thanks : John Nichols
Changes: The following are a list of changes
         since the previous version:
            > Added SSL implementation workaround
              option.
            > Added HTTP connection testing.
            > Fixed Certification validation XML
              output. 

Version: 1.7.1
Date   : 20/04/2008
Author : Ian Ventura-Whiting (Fizz)
Thanks : Mark Lowe
Changes: The following are a list of changes
         since the previous version:
            > Added HELO for SMTP checks
            > Increased read buffer size

Version: 1.7
Date   : 18/04/2008
Author : Ian Ventura-Whiting (Fizz)
Changes: The following are a list of changes
         since the previous version:
            > Added STARTTLS SMTP capability
            > Fixed XML output format bug

Version: 1.6
Date   : 30/12/2007
Author : Ian Ventura-Whiting (Fizz)
Changes: The following are a list of changes
         since the previous version:
            > Added man page.
            > Improved certificate checking
            > Added Makefile

Version: 1.5
Date   : 25/09/2007
Author : Ian Ventura-Whiting (Fizz)
Changes: The following are a list of changes
         since the previous version:
            > Update to the license to make it
              BINARY compatible with OpenSSL. Its
              then easier for the packagers.

Version: 1.4
Date   : 03/09/2007
Author : Ian Ventura-Whiting (Fizz)
Changes: The following are a list of changes
         since the previous version:
            > Added Server Certificate ouput.
            > Added support for client certs.
            > Added support for private keys
              and password.
            > Added support for PKCS#12.
            > Fixed xml output.

Version: 1.3
Date   : 06/08/2007
Author : Ian Ventura-Whiting (Fizz)
Changes: The following are a list of changes
         since the previous version:
            > Added XML file output option.
            > Improved help text.
            > Added program URL.

Version: 1.2
Date   : 16/07/2007
Author : Ian Ventura-Whiting (Fizz)
Changes: The following are a list of changes
         since the previous version:
            > Removed unused variable
            > Other minor changes.

Version: 1.1
Date   : 13/07/2007
Author : Ian Ventura-Whiting (Fizz)
Changes: The following are a list of changes
         since the previous version:
            > Correction in banner text
            > Host:Port now directly from the
              command-line.

Version: 1.0
Date   : 13/07/2007
Author : Ian Ventura-Whiting (Fizz)
Notes  : Initial version of sslscan

License

SSLScan is covered by GPL version 3 with the following exclusion:

In addition, as a special exception, the copyright holders give
permission to link the code of portions of this program with the
OpenSSL library under certain conditions as described in each
individual source file, and distribute linked combinations
including the two.
You must obey the GNU General Public License in all respects
for all of the code used other than OpenSSL.  If you modify
file(s) with this exception, you may extend this exception to your
version of the file(s), but you are not obligated to do so.  If you
do not wish to do so, delete this exception statement from your
version.  If you delete this exception statement from all source
files in the program, then also delete it here.

For detailed information about how to download this free tool go to www.titania-security.com/labs/sslscan

Banner Grab- Free Connection, Trigger Based and Basic Information Connection Tool

Banner Grab is a tool that performs connection, trigger-based and basic information collection from network services. The program has two modes of operation; simple connection banner grabbing and the default mode, which attempts to collect additional information using triggers and simple service queries.
Unlike a number of other banner grabbing tools, Banner Grab supports SSL and can perform banner grabbing on SSL-based services.

More information and the most up to date download version can be found via a link on the Titania website under 'Resources' or follow the link https://www.titania.com/freetools?tool=bannergrab and scroll down.

Requirements

Banner Grab requires the GNU C compiler and the OpenSSL library. Both of these are usually installed by default on a number of Linux distributions. Although this program has not been tested on other platforms it should work if the requirements have been met.

Building

To build Banner Grab, first extract the archive and change into the source directory. Then execute the following command:

gcc -lssl -o bannergrab bannergrab.c

On Mac OS-X you can use the following command:

gcc -lssl -lcrypto -o bannergrab bannergrab.c

If for some reason you need to compile it without SSL support, it can be done with the following command:

gcc -DNOSSL -o bannergrab bannergrab.c

Running

Banner Grab can be run, in its simplist form, by specifying the host and port as parameters.

The command line arguements for Banner Grab are:

Command:
  bannergrab [Options] host port

Options:
  --udp                Connect  to  a  port  using  UDP.   The
                       default is to use TCP.
  --no-triggers        Collect only the connection banner,
                       no triggers and no SSL.
  --trigger=  Specify  the  trigger  to use.  Specify
                       DEFAULT to use the default trigger.
  --no-ssl             Prevent SSL connection creation.
  --no-hex             Output containing non-printable
                       characters are converted to hex. This
                       option prevents the conversion.
  --conn-time=   Connection timeout (default is 5s).
  --read-time=   Read timeout (default is 3s).
  --verbose            Show additional program details
                       such as any errors.
  --show-triggers      Show the supported triggers.
  --version            Show the program version.
  --help               Display the help text you are
                       reading now.

Triggers

For those of you that do not want to go through the code here is a brief description of what Banner Grabs actions will be when connecting to a port. This is of course dependant on the user not simply disabling the triggers.
Banner Grab will look at the port number that has been specified and try to match it to a trigger/set of triggers. It does NOT probe the service to determine this. If a trigger is found for that port then it will use that, otherwise it will use the default one.
The triggers for the service will be sent one after another and the response captured. It is as simple as that.
The triggers do the following:

   FTP
     * Asks for help.
     * Attempts to login anonymously.
     * Quits.

   SMTP
     * Says Hello.
     * Asks for help.
     * Attempts to VRFY postmaster.
     * Attempts to VRFY bannergrab123.
     * Attempts to EXPN postmaster.
     * Quits.

   Telnet
     * Sends two carridge returns.

   Finger
     * Attempts to enumerate a few users.

   HTTP(S)
     * Asks for OPTIONS.

   POP2/3
     * Quits.

   NNTP
     * Asks for HELP.
     * Lists the newsgroups.
     * Quits.

   FW1 Admin
     * Attempts to list IPs.

   FW1 Auth
     * Sends two carridge returns.

   LDAP(S)
     * Performs an Anonymous bind.
     * Gets a list of base Distinguished
       Names (DN).

   MSSQL
     * Attempts a login using BannerGrab
       user.

   MySQL
     * Waits longer for a MySQL response.

   Discard/Echo
     * Send echo.

   Chargen/Daytime/QOTD/SSH/VMWare/Printer
     * Send nothing.

   NTP
     * Queries time
     * Queries read list
     * Queries peers

   SNMP
     * Sends "public" community string
     * Sends "private" community string

   NetBIOS Name Service
     * Name query

   ALL OTHERS (Default)
     * Send OPTIONS and ask for HELP.

Licence

SSLScan is covered by the GPL version 3 licence with the following exclusion:

In addition, as a special exception, the copyright holders give
permission to link the code of portions of this program with the
OpenSSL library under certain conditions as described in each
individual source file, and distribute linked combinations
including the two.
You must obey the GNU General Public License in all respects
for all of the code used other than OpenSSL.  If you modify
file(s) with this exception, you may extend this exception to your
version of the file(s), but you are not obligated to do so.  If you
do not wish to do so, delete this exception statement from your
version.  If you delete this exception statement from all source
files in the program, then also delete it here.

You can get a copy of the GPLv3 license from www.titania-security.com

For legacy downloads and the latest download please go to the 'Resources' on the Titania website or follow the link https://www.titania.com/freetools?tool=bannergrab