Auditing the strength of cipher suites in SSL servers

SSL attacks are very popular these days, and it is prevalent to see servers accepting insecure cipher and compression methods. We can use Nmap to quickly evaluate the strength of the cipher suites used in servers in an automated way.

This recipe shows how to list and audit the strength of the cipher suites supported by an HTTPS server with Nmap.

How to do it...

Use the ssl-enum-ciphers NSE script to obtain a list of supported cipher suites and their security rating:

$ nmap --script ssl-enum-ciphers -sV <target>

Warnings will be thrown if misconfigurations are detected:

| ssl-enum-ciphers: 
|   TLSv1.0: 
|     ciphers: 
|       TLS_RSA_WITH_3DES_EDE_CBC_SHA (rsa 2048) - C
|     compressors: 
|       NULL
|     cipher preference: server
|  ...