Hunting for SSL flaws
Most of the web applications today use SSL to communicate with the server. The sslscan
is a great tool to check SSL for flaws or misconfigurations.
How to do it...
To learn about sslscan
follow the given steps:
- We will look at the help manual to see the various options the tool has:
sslscan -h
The following screenshot shows the output of the preceding command:
- To run the tool against a host we type the following:
sslscan host.com:port
The following screenshot shows the output of the preceding command:
See also
- The A tale of a bleeding heart recipe from Chapter 5, Network Exploitation on Current Exploitation
TLSSLed is also an alternative we can use in Kali to perform checks on SSL.