Class: Rex::SSLScan::Scanner

Inherits:
Object
  • Object
show all
Defined in:
lib/rex/sslscan/scanner.rb

Defined Under Namespace

Classes: InvalidCipher

Instance Attribute Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(host, port = 443, context = {}, timeout = 5) ⇒ Scanner

Initializes the scanner object

Parameters:

  • host (String) —

    IP address or hostname to scan

  • port (Integer) (defaults to: 443) —

    Port number to scan, default: 443

  • timeout (Integer) (defaults to: 5) —

    Timeout for connections, in seconds. default: 5

Raises:

  • (StandardError) —

    Raised when the configuration is invalid



25
26
27
28
29
30
31
32
33
34
35
36
37
38
 
# File 'lib/rex/sslscan/scanner.rb', line 25

def initialize(host,port = 443,context = {},timeout=5)
  @host       = host
  @port       = port
  @timeout    = timeout
  @context    = context
  if check_opensslv2 == true
    @supported_versions = [:SSLv2, :SSLv3, :TLSv1, :TLSv1_1, :TLSv1_2]
    @sslv2 = true
  else
    @supported_versions = [:SSLv3, :TLSv1, :TLSv1_1, :TLSv1_2]
    @sslv2 = false
  end
  raise StandardError, "The scanner configuration is invalid" unless valid?
end

Instance Attribute Details

#context ⇒ Object

Returns the value of attribute context.



12
13
14
 
# File 'lib/rex/sslscan/scanner.rb', line 12

def context
  @context
end

#host ⇒ Object

Returns the value of attribute host.



13
14
15
 
# File 'lib/rex/sslscan/scanner.rb', line 13

def host
  @host
end

#port ⇒ Object

Returns the value of attribute port.



14
15
16
 
# File 'lib/rex/sslscan/scanner.rb', line 14

def port
  @port
end

#sslv2 ⇒ Object (readonly)

Returns the value of attribute sslv2.



18
19
20
 
# File 'lib/rex/sslscan/scanner.rb', line 18

def sslv2
  @sslv2
end

#supported_versions ⇒ Object (readonly)

Returns the value of attribute supported_versions.



17
18
19
 
# File 'lib/rex/sslscan/scanner.rb', line 17

def supported_versions
  @supported_versions
end

#timeout ⇒ Object

Returns the value of attribute timeout.



15
16
17
 
# File 'lib/rex/sslscan/scanner.rb', line 15

def timeout
  @timeout
end

Instance Method Details

#get_cert(ssl_version, cipher) ⇒ OpenSSL::X509::Certificate, Nil

Retrieve the X509 Cert from the target service,

Parameters:

  • ssl_version (Symbol) —

    The SSL version to use (:SSLv2, :SSLv3, :TLSv1)

  • cipher (String) —

    The SSL Cipher to use

Returns:

  • (OpenSSL::X509::Certificate) —

    if the certificate was retrieved

  • (Nil) —

    if the cert couldn't be retrieved



161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
 
# File 'lib/rex/sslscan/scanner.rb', line 161

def get_cert(ssl_version, cipher)
  validate_params(ssl_version,cipher)
  begin
    scan_client = Rex::Socket::Tcp.create(
      'PeerHost'   => @host,
      'PeerPort'   => @port,
      'SSL'        => true,
      'SSLVersion' => ssl_version,
      'SSLCipher'  => cipher,
      'Timeout'    => @timeout
    )
    cert = scan_client.peer_cert
    if cert.kind_of? OpenSSL::X509::Certificate
      return cert
    else
      return nil
    end
  rescue ::Exception => e
    return nil
  ensure
    if scan_client
      scan_client.close
    end
  end
end

#scan ⇒ Result

Initiate the Scan against the target. Will test each cipher one at a time.

Returns:

  • (Result) —

    object containing the details of the scan



53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
 
# File 'lib/rex/sslscan/scanner.rb', line 53

def scan
  scan_result = Rex::SSLScan::Result.new
  scan_result.openssl_sslv2 = sslv2
  # If we can't get any SSL connection, then don't bother testing
  # individual ciphers.
  if test_ssl == :rejected and test_tls == :rejected
    return scan_result
  end

  threads = []
  ciphers = Queue.new
  @supported_versions.each do |ssl_version|
    sslctx = OpenSSL::SSL::SSLContext.new(ssl_version)
    sslctx.ciphers.each do |cipher_name, ssl_ver, key_length, alg_length|
      threads << Thread.new do
        begin
          status = test_cipher(ssl_version, cipher_name)
          ciphers << [ssl_version, cipher_name, key_length, status]
          if status == :accepted and scan_result.cert.nil?
            scan_result.cert = get_cert(ssl_version, cipher_name)
          end
        rescue Rex::SSLScan::Scanner::InvalidCipher
          next
        end
      end
    end
  end
  threads.each { |thr| thr.join }

  until ciphers.empty? do
    cipher = ciphers.pop
    scan_result.add_cipher(*cipher)
  end
  scan_result
end

#test_cipher(ssl_version, cipher) ⇒ Symbol

Tests the specified SSL Version and Cipher against the configured target

Parameters:

  • ssl_version (Symbol) —

    The SSL version to use (:SSLv2, :SSLv3, :TLSv1)

  • cipher (String) —

    The SSL Cipher to use

Returns:

  • (Symbol) —

    Either :accepted or :rejected



133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
 
# File 'lib/rex/sslscan/scanner.rb', line 133

def test_cipher(ssl_version, cipher)
  validate_params(ssl_version,cipher)
  begin
    scan_client = Rex::Socket::Tcp.create(
      'Context'    => @context,
      'PeerHost'   => @host,
      'PeerPort'   => @port,
      'SSL'        => true,
      'SSLVersion' => ssl_version,
      'SSLCipher'  => cipher,
      'Timeout'    => @timeout
    )
  rescue ::Exception => e
    return :rejected
  ensure
    if scan_client
      scan_client.close
    end
  end

  return :accepted
end

#test_ssl ⇒ Object 



89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
 
# File 'lib/rex/sslscan/scanner.rb', line 89

def test_ssl
  begin
    scan_client = Rex::Socket::Tcp.create(
      'Context'    => @context,
      'PeerHost'   => @host,
      'PeerPort'   => @port,
      'SSL'        => true,
      'SSLVersion' => :SSLv23,
      'Timeout'    => @timeout
    )
  rescue ::Exception => e
    return :rejected
  ensure
    if scan_client
      scan_client.close
    end
  end
  return :accepted
end

#test_tls ⇒ Object 



109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
 
# File 'lib/rex/sslscan/scanner.rb', line 109

def test_tls
  begin
    scan_client = Rex::Socket::Tcp.create(
      'Context'    => @context,
      'PeerHost'   => @host,
      'PeerPort'   => @port,
      'SSL'        => true,
      'SSLVersion' => :TLSv1,
      'Timeout'    => @timeout
    )
  rescue ::Exception => e
    return :rejected
  ensure
    if scan_client
      scan_client.close
    end
  end
  return :accepted
end

#valid? ⇒ Boolean

Checks whether the scanner option has a valid configuration

Returns:

  • (Boolean) —

    True or False, the configuration is valid.



42
43
44
45
46
47
48
49
 
# File 'lib/rex/sslscan/scanner.rb', line 42

def valid?
  begin
    @host = Rex::Socket.getaddress(@host, true)
  rescue
    return false
  end
  @port.kind_of?(Integer) && @port >= 0 && @port <= 65535 && @timeout.kind_of?(Integer)
end