-
Notifications
You must be signed in to change notification settings - Fork 8
/
ssl-cipher-suite-enum.pl
executable file
·1742 lines (1595 loc) · 63.6 KB
/
ssl-cipher-suite-enum.pl
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
#!/usr/bin/perl
# ssl-cipher-suite-enum
# Copyright (C) 2014 Mark lowe (mrl@portcullis-security.com)
#
# This tool may be used for legal purposes only. Users take full responsibility
# for any actions performed using this tool. The author accepts no liability
# for damage caused by this tool. If these terms are not acceptable to you, then
# do not use this tool.
#
# In all other respects the GPL version 2 applies:
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License version 2 as
# published by the Free Software Foundation.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License along
# with this program; if not, write to the Free Software Foundation, Inc.,
# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
#
# You are encouraged to send comments, improvements or suggestions to
# me at mrl@portcullis-security.com
#
use strict;
use warnings;
use IO::Socket::INET;
use Getopt::Long;
my $VERSION = "1.0.2";
my $usage = "ssl-cipher-suite-enum v$VERSION ( http://labs.portcullis.co.uk/application/ssl-cipher-suite-enum/ )
Copyright (C) 2012 Mark Lowe (mrl\@portcullis-security.com)
ssl-cipher-suite-enum.pl [ options ] ( --file hosts.txt | host | host:port )
options are:
--sslv2_0 or --sslv2
--sslv3_0 or --sslv3
--tlsv1_0 or --tlsv1 or --sslv3_1
--tlsv1_1 or --sslv3_2
--tlsv1_2 or --sslv3_3
--persist Keep trying when protocol doesn't seem to be
supported by the server (rarely needed)
--rdp Send RDP protocol preamble before talking SSL
--smtp Send SMTP STARTTLS before talking SSL
--ftp Send FTP AUTH SSL talking SSL
--mysql Send mysql STARTTLS
--file hosts.txt Hosts to scan
--outfile out.txt Log output to file too
--rate n Limit to n connections/sec. Default: unlimited
--verbose
--debug
--help
Examples:
Scan for cipher suites supported by all SSL protocols (port 443):
ssl-cipher-suite-enum.pl www.example.com
Scan only SSLv2 cipher suites on port 8834:
ssl-cipher-suite-enum.pl --sslv2 www.example.com:8834
Scan only TLSv1.1 and TLSv1.2:
ssl-cipher-suite-enum.pl --tlsv1_1 --tlsv1_2 www.example.com
Scan a lots of hosts (each line is 'host' or 'host:port'):
ssl-cipher-suite-enum.pl --file hosts.txt
Scan RDP server (could support SSL with or without RDP handshake):
ssl-cipher-suite-enum.pl 10.0.0.1:3389
ssl-cipher-suite-enum.pl --rdp 10.0.0.1:3389
Send HELO x, STARTTLS preamble to SMTP server before SSL scanning:
ssl-cipher-suite-enum.pl --smtp 10.0.0.1:25
";
my $sslv2_0 = 0;
my $sslv3_0 = 0;
my $tlsv1_0 = 0;
my $tlsv1_1 = 0;
my $tlsv1_2 = 0;
my $hostfile = undef;
my $outfile = undef;
my $debug = 0;
my $verbose = 0;
my $global_connection_count = 0;
my $help = 0;
my %results = ();
my $global_rate = undef;
my $global_rdp = 0;
my $global_smtp = 0;
my $global_ftp = 0;
my $global_mysql = 0;
my $global_persist = 0;
my $global_recv_timeout = 10;
my $global_connect_fail_count = 5;
my $result = GetOptions (
"sslv2_0" => \$sslv2_0,
"sslv2" => \$sslv2_0,
"sslv3_0" => \$sslv3_0,
"sslv3" => \$sslv3_0,
"tlsv1_0" => \$tlsv1_0,
"tlsv1" => \$tlsv1_0,
"tlsv1_0" => \$tlsv1_0,
"sslv3_1" => \$tlsv1_0,
"tlsv1_1" => \$tlsv1_1,
"sslv3_2" => \$tlsv1_1,
"tlsv1_2" => \$tlsv1_2,
"sslv3_3" => \$tlsv1_2,
"rdp" => \$global_rdp,
"smtp" => \$global_smtp,
"ftp" => \$global_ftp,
"mysql" => \$global_mysql,
"file=s" => \$hostfile,
"rate=s" => \$global_rate,
"timeout_recv=s" => \$global_recv_timeout,
"outfile=s" => \$outfile,
"verbose" => \$verbose,
"debug" => \$debug,
"persist" => \$global_persist,
"help" => \$help
);
if ($help) {
print $usage;
exit 0;
}
if ($debug) {
use Data::Dumper;
use warnings FATAL => 'all';
use Carp qw(confess); # for debugging
$SIG{ __DIE__ } = sub { confess( @_ ) }; # for debugging
}
# If no options were supplied, test everything
if ($sslv2_0 == 0 and $sslv3_0 == 0 and $tlsv1_0 == 0 and $tlsv1_1 == 0 and $tlsv1_2 == 0) {
$sslv2_0 = 1;
$sslv3_0 = 1;
$tlsv1_0 = 1;
$tlsv1_1 = 1;
$tlsv1_2 = 1;
}
if (defined($outfile)){
# http://stackoverflow.com/questions/1631873/copy-all-output-of-a-perl-script-into-a-file
use Symbol;
my @handles = (*STDOUT);
my $handle = gensym( );
push(@handles, $handle);
open $handle, ">$outfile" or die "[E] Can't write to $outfile: $!\n"; #open for write, overwrite;
tie *TEE, "Tie::Tee", @handles;
select(TEE);
*STDERR = *TEE;
}
$global_persist = 1 if $global_ftp;
my @protos_to_test = ();
push @protos_to_test, "0200" if $sslv2_0;
push @protos_to_test, "0300" if $sslv3_0;
push @protos_to_test, "0301" if $tlsv1_0;
push @protos_to_test, "0302" if $tlsv1_1;
push @protos_to_test, "0303" if $tlsv1_2;
my $protos_to_test = join(",", map {get_protocol_name($_)} @protos_to_test);
my @targets = ();
if (defined($hostfile)) {
open HOSTS, "<$hostfile" or die "[E] Can't open $hostfile: $!\n";
while (<HOSTS>) {
chomp; chomp;
my $line = $_;
my $port = 443;
my $host = $line;
if ($line =~ /\s*(\S+):(\d+)\s*/) {
$host = $1;
$port = $2;
}
my $ip = resolve($host);
if (defined($ip)) {
push @targets, { ip => $ip, hostname => $host, port => $port };
} else {
print "[W] Unable to resolve host $host. Ignoring line: $line\n";
}
}
} else {
my $host = shift or die $usage;
my $port = 443;
if ($host =~ /\s*(\S+):(\d+)\s*/) {
$host = $1;
$port = $2;
}
my $ip = resolve($host);
unless (defined($ip)) {
die "[E] Can't resolve hostname $host\n";
}
push @targets, { ip => $ip, hostname => $host, port => $port };
}
# Most of the TLS cipher suites are listed on http://www.iana.org/assignments/tls-parameters/tls-parameters.xml
my $ciphersuitenamestring = "
0x0000 TLS_NULL_WITH_NULL_NULL [RFC5246]
0x0001 TLS_RSA_WITH_NULL_MD5 [RFC5246]
0x0002 TLS_RSA_WITH_NULL_SHA [RFC5246]
0x0003 TLS_RSA_EXPORT_WITH_RC4_40_MD5 [RFC4346][RFC6347]
0x0004 TLS_RSA_WITH_RC4_128_MD5 [RFC5246][RFC6347]
0x0005 TLS_RSA_WITH_RC4_128_SHA [RFC5246][RFC6347]
0x0006 TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5 [RFC4346]
0x0007 TLS_RSA_WITH_IDEA_CBC_SHA [RFC5469]
0x0008 TLS_RSA_EXPORT_WITH_DES40_CBC_SHA [RFC4346]
0x0009 TLS_RSA_WITH_DES_CBC_SHA [RFC5469]
0x000A TLS_RSA_WITH_3DES_EDE_CBC_SHA [RFC5246]
0x000B TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA [RFC4346]
0x000C TLS_DH_DSS_WITH_DES_CBC_SHA [RFC5469]
0x000D TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA [RFC5246]
0x000E TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA [RFC4346]
0x000F TLS_DH_RSA_WITH_DES_CBC_SHA [RFC5469]
0x0010 TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA [RFC5246]
0x0011 TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA [RFC4346]
0x0012 TLS_DHE_DSS_WITH_DES_CBC_SHA [RFC5469]
0x0013 TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA [RFC5246]
0x0014 TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA [RFC4346]
0x0015 TLS_DHE_RSA_WITH_DES_CBC_SHA [RFC5469]
0x0016 TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA [RFC5246]
0x0017 TLS_DH_anon_EXPORT_WITH_RC4_40_MD5 [RFC4346][RFC6347]
0x0018 TLS_DH_anon_WITH_RC4_128_MD5 [RFC5246][RFC6347]
0x0019 TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA [RFC4346]
0x001A TLS_DH_anon_WITH_DES_CBC_SHA [RFC5469]
0x001B TLS_DH_anon_WITH_3DES_EDE_CBC_SHA [RFC5246]
0x001E TLS_KRB5_WITH_DES_CBC_SHA [RFC2712]
0x001F TLS_KRB5_WITH_3DES_EDE_CBC_SHA [RFC2712]
0x0020 TLS_KRB5_WITH_RC4_128_SHA [RFC2712][RFC6347]
0x0021 TLS_KRB5_WITH_IDEA_CBC_SHA [RFC2712]
0x0022 TLS_KRB5_WITH_DES_CBC_MD5 [RFC2712]
0x0023 TLS_KRB5_WITH_3DES_EDE_CBC_MD5 [RFC2712]
0x0024 TLS_KRB5_WITH_RC4_128_MD5 [RFC2712][RFC6347]
0x0025 TLS_KRB5_WITH_IDEA_CBC_MD5 [RFC2712]
0x0026 TLS_KRB5_EXPORT_WITH_DES_CBC_40_SHA [RFC2712]
0x0027 TLS_KRB5_EXPORT_WITH_RC2_CBC_40_SHA [RFC2712]
0x0028 TLS_KRB5_EXPORT_WITH_RC4_40_SHA [RFC2712][RFC6347]
0x0029 TLS_KRB5_EXPORT_WITH_DES_CBC_40_MD5 [RFC2712]
0x002A TLS_KRB5_EXPORT_WITH_RC2_CBC_40_MD5 [RFC2712]
0x002B TLS_KRB5_EXPORT_WITH_RC4_40_MD5 [RFC2712][RFC6347]
0x002C TLS_PSK_WITH_NULL_SHA [RFC4785]
0x002D TLS_DHE_PSK_WITH_NULL_SHA [RFC4785]
0x002E TLS_RSA_PSK_WITH_NULL_SHA [RFC4785]
0x002F TLS_RSA_WITH_AES_128_CBC_SHA [RFC5246]
0x0030 TLS_DH_DSS_WITH_AES_128_CBC_SHA [RFC5246]
0x0031 TLS_DH_RSA_WITH_AES_128_CBC_SHA [RFC5246]
0x0032 TLS_DHE_DSS_WITH_AES_128_CBC_SHA [RFC5246]
0x0033 TLS_DHE_RSA_WITH_AES_128_CBC_SHA [RFC5246]
0x0034 TLS_DH_anon_WITH_AES_128_CBC_SHA [RFC5246]
0x0035 TLS_RSA_WITH_AES_256_CBC_SHA [RFC5246]
0x0036 TLS_DH_DSS_WITH_AES_256_CBC_SHA [RFC5246]
0x0037 TLS_DH_RSA_WITH_AES_256_CBC_SHA [RFC5246]
0x0038 TLS_DHE_DSS_WITH_AES_256_CBC_SHA [RFC5246]
0x0039 TLS_DHE_RSA_WITH_AES_256_CBC_SHA [RFC5246]
0x003A TLS_DH_anon_WITH_AES_256_CBC_SHA [RFC5246]
0x003B TLS_RSA_WITH_NULL_SHA256 [RFC5246]
0x003C TLS_RSA_WITH_AES_128_CBC_SHA256 [RFC5246]
0x003D TLS_RSA_WITH_AES_256_CBC_SHA256 [RFC5246]
0x003E TLS_DH_DSS_WITH_AES_128_CBC_SHA256 [RFC5246]
0x003F TLS_DH_RSA_WITH_AES_128_CBC_SHA256 [RFC5246]
0x0040 TLS_DHE_DSS_WITH_AES_128_CBC_SHA256 [RFC5246]
0x0041 TLS_RSA_WITH_CAMELLIA_128_CBC_SHA [RFC5932]
0x0042 TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA [RFC5932]
0x0043 TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA [RFC5932]
0x0044 TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA [RFC5932]
0x0045 TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA [RFC5932]
0x0046 TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA [RFC5932]
0x0062 TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA http://tools.ietf.org/html/draft-ietf-tls-56-bit-ciphersuites-01
0x0063 TLS_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA http://tools.ietf.org/html/draft-ietf-tls-56-bit-ciphersuites-01
0x0064 TLS_RSA_EXPORT1024_WITH_RC4_56_SHA http://tools.ietf.org/html/draft-ietf-tls-56-bit-ciphersuites-01
0x0065 TLS_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA http://tools.ietf.org/html/draft-ietf-tls-56-bit-ciphersuites-01
0x0066 TLS_DHE_DSS_WITH_RC4_128_SHA http://tools.ietf.org/html/draft-ietf-tls-56-bit-ciphersuites-01
0x0067 TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 [RFC5246]
0x0068 TLS_DH_DSS_WITH_AES_256_CBC_SHA256 [RFC5246]
0x0069 TLS_DH_RSA_WITH_AES_256_CBC_SHA256 [RFC5246]
0x006A TLS_DHE_DSS_WITH_AES_256_CBC_SHA256 [RFC5246]
0x006B TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 [RFC5246]
0x006C TLS_DH_anon_WITH_AES_128_CBC_SHA256 [RFC5246]
0x006D TLS_DH_anon_WITH_AES_256_CBC_SHA256 [RFC5246]
0x0072 TLS_DHE_DSS_WITH_3DES_EDE_CBC_RMD160 mysql.yassl
0x0073 TLS_DHE_DSS_WITH_AES_128_CBC_RMD160 mysql.yassl
0x0074 TLS_DHE_DSS_WITH_AES_256_CBC_RMD160 mysql.yassl
0x0077 TLS_DHE_RSA_WITH_3DES_EDE_CBC_RMD160 mysql.yassl
0x0078 TLS_DHE_RSA_WITH_AES_128_CBC_RMD160 mysql.yassl
0x0079 TLS_DHE_RSA_WITH_AES_256_CBC_RMD160 mysql.yassl
0x007C TLS_RSA_WITH_3DES_EDE_CBC_RMD160 mysql.yassl
0x007D TLS_RSA_WITH_AES_128_CBC_RMD160 mysql.yassl
0x007E TLS_RSA_WITH_AES_256_CBC_RMD160 mysql.yassl
0x0080 TLS_GOSTR341094_WITH_28147_CNT_IMIT http://tools.ietf.org/html/draft-chudov-cryptopro-cptls-04
0x0081 TLS_GOSTR341001_WITH_28147_CNT_IMIT http://tools.ietf.org/html/draft-chudov-cryptopro-cptls-04
0x0082 TLS_GOSTR341094_WITH_NULL_GOSTR3411 http://tools.ietf.org/html/draft-chudov-cryptopro-cptls-04
0x0083 TLS_GOSTR341001_WITH_NULL_GOSTR3411 http://tools.ietf.org/html/draft-chudov-cryptopro-cptls-04
0x0084 TLS_RSA_WITH_CAMELLIA_256_CBC_SHA [RFC5932]
0x0085 TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA [RFC5932]
0x0086 TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA [RFC5932]
0x0087 TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA [RFC5932]
0x0088 TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA [RFC5932]
0x0089 TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA [RFC5932]
0x008A TLS_PSK_WITH_RC4_128_SHA [RFC4279][RFC6347]
0x008B TLS_PSK_WITH_3DES_EDE_CBC_SHA [RFC4279]
0x008C TLS_PSK_WITH_AES_128_CBC_SHA [RFC4279]
0x008D TLS_PSK_WITH_AES_256_CBC_SHA [RFC4279]
0x008E TLS_DHE_PSK_WITH_RC4_128_SHA [RFC4279][RFC6347]
0x008F TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA [RFC4279]
0x0090 TLS_DHE_PSK_WITH_AES_128_CBC_SHA [RFC4279]
0x0091 TLS_DHE_PSK_WITH_AES_256_CBC_SHA [RFC4279]
0x0092 TLS_RSA_PSK_WITH_RC4_128_SHA [RFC4279][RFC6347]
0x0093 TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA [RFC4279]
0x0094 TLS_RSA_PSK_WITH_AES_128_CBC_SHA [RFC4279]
0x0095 TLS_RSA_PSK_WITH_AES_256_CBC_SHA [RFC4279]
0x0096 TLS_RSA_WITH_SEED_CBC_SHA [RFC4162]
0x0097 TLS_DH_DSS_WITH_SEED_CBC_SHA [RFC4162]
0x0098 TLS_DH_RSA_WITH_SEED_CBC_SHA [RFC4162]
0x0099 TLS_DHE_DSS_WITH_SEED_CBC_SHA [RFC4162]
0x009A TLS_DHE_RSA_WITH_SEED_CBC_SHA [RFC4162]
0x009B TLS_DH_anon_WITH_SEED_CBC_SHA [RFC4162]
0x009C TLS_RSA_WITH_AES_128_GCM_SHA256 [RFC5288]
0x009D TLS_RSA_WITH_AES_256_GCM_SHA384 [RFC5288]
0x009E TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 [RFC5288]
0x009F TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 [RFC5288]
0x00A0 TLS_DH_RSA_WITH_AES_128_GCM_SHA256 [RFC5288]
0x00A1 TLS_DH_RSA_WITH_AES_256_GCM_SHA384 [RFC5288]
0x00A2 TLS_DHE_DSS_WITH_AES_128_GCM_SHA256 [RFC5288]
0x00A3 TLS_DHE_DSS_WITH_AES_256_GCM_SHA384 [RFC5288]
0x00A4 TLS_DH_DSS_WITH_AES_128_GCM_SHA256 [RFC5288]
0x00A5 TLS_DH_DSS_WITH_AES_256_GCM_SHA384 [RFC5288]
0x00A6 TLS_DH_anon_WITH_AES_128_GCM_SHA256 [RFC5288]
0x00A7 TLS_DH_anon_WITH_AES_256_GCM_SHA384 [RFC5288]
0x00A8 TLS_PSK_WITH_AES_128_GCM_SHA256 [RFC5487]
0x00A9 TLS_PSK_WITH_AES_256_GCM_SHA384 [RFC5487]
0x00AA TLS_DHE_PSK_WITH_AES_128_GCM_SHA256 [RFC5487]
0x00AB TLS_DHE_PSK_WITH_AES_256_GCM_SHA384 [RFC5487]
0x00AC TLS_RSA_PSK_WITH_AES_128_GCM_SHA256 [RFC5487]
0x00AD TLS_RSA_PSK_WITH_AES_256_GCM_SHA384 [RFC5487]
0x00AE TLS_PSK_WITH_AES_128_CBC_SHA256 [RFC5487]
0x00AF TLS_PSK_WITH_AES_256_CBC_SHA384 [RFC5487]
0x00B0 TLS_PSK_WITH_NULL_SHA256 [RFC5487]
0x00B1 TLS_PSK_WITH_NULL_SHA384 [RFC5487]
0x00B2 TLS_DHE_PSK_WITH_AES_128_CBC_SHA256 [RFC5487]
0x00B3 TLS_DHE_PSK_WITH_AES_256_CBC_SHA384 [RFC5487]
0x00B4 TLS_DHE_PSK_WITH_NULL_SHA256 [RFC5487]
0x00B5 TLS_DHE_PSK_WITH_NULL_SHA384 [RFC5487]
0x00B6 TLS_RSA_PSK_WITH_AES_128_CBC_SHA256 [RFC5487]
0x00B7 TLS_RSA_PSK_WITH_AES_256_CBC_SHA384 [RFC5487]
0x00B8 TLS_RSA_PSK_WITH_NULL_SHA256 [RFC5487]
0x00B9 TLS_RSA_PSK_WITH_NULL_SHA384 [RFC5487]
0x00BA TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256 [RFC5932]
0x00BB TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA256 [RFC5932]
0x00BC TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA256 [RFC5932]
0x00BD TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA256 [RFC5932]
0x00BE TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 [RFC5932]
0x00BF TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA256 [RFC5932]
0x00FF TLS_EMPTY_RENEGOTIATION_INFO_SCSV [RFC5746]
0x00C0 TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256 [RFC5932]
0x00C1 TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA256 [RFC5932]
0x00C2 TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA256 [RFC5932]
0x00C3 TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA256 [RFC5932]
0x00C4 TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256 [RFC5932]
0x00C5 TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA256 [RFC5932]
0xC001 TLS_ECDH_ECDSA_WITH_NULL_SHA [RFC4492]
0xC002 TLS_ECDH_ECDSA_WITH_RC4_128_SHA [RFC4492][RFC6347]
0xC003 TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA [RFC4492]
0xC004 TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA [RFC4492]
0xC005 TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA [RFC4492]
0xC006 TLS_ECDHE_ECDSA_WITH_NULL_SHA [RFC4492]
0xC007 TLS_ECDHE_ECDSA_WITH_RC4_128_SHA [RFC4492][RFC6347]
0xC008 TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA [RFC4492]
0xC009 TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA [RFC4492]
0xC00A TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA [RFC4492]
0xC00B TLS_ECDH_RSA_WITH_NULL_SHA [RFC4492]
0xC00C TLS_ECDH_RSA_WITH_RC4_128_SHA [RFC4492][RFC6347]
0xC00D TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA [RFC4492]
0xC00E TLS_ECDH_RSA_WITH_AES_128_CBC_SHA [RFC4492]
0xC00F TLS_ECDH_RSA_WITH_AES_256_CBC_SHA [RFC4492]
0xC010 TLS_ECDHE_RSA_WITH_NULL_SHA [RFC4492]
0xC011 TLS_ECDHE_RSA_WITH_RC4_128_SHA [RFC4492][RFC6347]
0xC012 TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA [RFC4492]
0xC013 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA [RFC4492]
0xC014 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA [RFC4492]
0xC015 TLS_ECDH_anon_WITH_NULL_SHA [RFC4492]
0xC016 TLS_ECDH_anon_WITH_RC4_128_SHA [RFC4492][RFC6347]
0xC017 TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA [RFC4492]
0xC018 TLS_ECDH_anon_WITH_AES_128_CBC_SHA [RFC4492]
0xC019 TLS_ECDH_anon_WITH_AES_256_CBC_SHA [RFC4492]
0xC01A TLS_SRP_SHA_WITH_3DES_EDE_CBC_SHA [RFC5054]
0xC01B TLS_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA [RFC5054]
0xC01C TLS_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA [RFC5054]
0xC01D TLS_SRP_SHA_WITH_AES_128_CBC_SHA [RFC5054]
0xC01E TLS_SRP_SHA_RSA_WITH_AES_128_CBC_SHA [RFC5054]
0xC01F TLS_SRP_SHA_DSS_WITH_AES_128_CBC_SHA [RFC5054]
0xC020 TLS_SRP_SHA_WITH_AES_256_CBC_SHA [RFC5054]
0xC021 TLS_SRP_SHA_RSA_WITH_AES_256_CBC_SHA [RFC5054]
0xC022 TLS_SRP_SHA_DSS_WITH_AES_256_CBC_SHA [RFC5054]
0xC023 TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 [RFC5289]
0xC024 TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 [RFC5289]
0xC025 TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256 [RFC5289]
0xC026 TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384 [RFC5289]
0xC027 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 [RFC5289]
0xC028 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 [RFC5289]
0xC029 TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256 [RFC5289]
0xC02A TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384 [RFC5289]
0xC02B TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 [RFC5289]
0xC02C TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 [RFC5289]
0xC02D TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 [RFC5289]
0xC02E TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384 [RFC5289]
0xC02F TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 [RFC5289]
0xC030 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 [RFC5289]
0xC031 TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256 [RFC5289]
0xC032 TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384 [RFC5289]
0xC033 TLS_ECDHE_PSK_WITH_RC4_128_SHA [RFC5489][RFC6347]
0xC034 TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA [RFC5489]
0xC035 TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA [RFC5489]
0xC036 TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA [RFC5489]
0xC037 TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256 [RFC5489]
0xC038 TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384 [RFC5489]
0xC039 TLS_ECDHE_PSK_WITH_NULL_SHA [RFC5489]
0xC03A TLS_ECDHE_PSK_WITH_NULL_SHA256 [RFC5489]
0xC03B TLS_ECDHE_PSK_WITH_NULL_SHA384 [RFC5489]
0xC03C TLS_RSA_WITH_ARIA_128_CBC_SHA256 [RFC6209]
0xC03D TLS_RSA_WITH_ARIA_256_CBC_SHA384 [RFC6209]
0xC03E TLS_DH_DSS_WITH_ARIA_128_CBC_SHA256 [RFC6209]
0xC03F TLS_DH_DSS_WITH_ARIA_256_CBC_SHA384 [RFC6209]
0xC040 TLS_DH_RSA_WITH_ARIA_128_CBC_SHA256 [RFC6209]
0xC041 TLS_DH_RSA_WITH_ARIA_256_CBC_SHA384 [RFC6209]
0xC042 TLS_DHE_DSS_WITH_ARIA_128_CBC_SHA256 [RFC6209]
0xC043 TLS_DHE_DSS_WITH_ARIA_256_CBC_SHA384 [RFC6209]
0xC044 TLS_DHE_RSA_WITH_ARIA_128_CBC_SHA256 [RFC6209]
0xC045 TLS_DHE_RSA_WITH_ARIA_256_CBC_SHA384 [RFC6209]
0xC046 TLS_DH_anon_WITH_ARIA_128_CBC_SHA256 [RFC6209]
0xC047 TLS_DH_anon_WITH_ARIA_256_CBC_SHA384 [RFC6209]
0xC048 TLS_ECDHE_ECDSA_WITH_ARIA_128_CBC_SHA256 [RFC6209]
0xC049 TLS_ECDHE_ECDSA_WITH_ARIA_256_CBC_SHA384 [RFC6209]
0xC04A TLS_ECDH_ECDSA_WITH_ARIA_128_CBC_SHA256 [RFC6209]
0xC04B TLS_ECDH_ECDSA_WITH_ARIA_256_CBC_SHA384 [RFC6209]
0xC04C TLS_ECDHE_RSA_WITH_ARIA_128_CBC_SHA256 [RFC6209]
0xC04D TLS_ECDHE_RSA_WITH_ARIA_256_CBC_SHA384 [RFC6209]
0xC04E TLS_ECDH_RSA_WITH_ARIA_128_CBC_SHA256 [RFC6209]
0xC04F TLS_ECDH_RSA_WITH_ARIA_256_CBC_SHA384 [RFC6209]
0xC050 TLS_RSA_WITH_ARIA_128_GCM_SHA256 [RFC6209]
0xC051 TLS_RSA_WITH_ARIA_256_GCM_SHA384 [RFC6209]
0xC052 TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256 [RFC6209]
0xC053 TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384 [RFC6209]
0xC054 TLS_DH_RSA_WITH_ARIA_128_GCM_SHA256 [RFC6209]
0xC055 TLS_DH_RSA_WITH_ARIA_256_GCM_SHA384 [RFC6209]
0xC056 TLS_DHE_DSS_WITH_ARIA_128_GCM_SHA256 [RFC6209]
0xC057 TLS_DHE_DSS_WITH_ARIA_256_GCM_SHA384 [RFC6209]
0xC058 TLS_DH_DSS_WITH_ARIA_128_GCM_SHA256 [RFC6209]
0xC059 TLS_DH_DSS_WITH_ARIA_256_GCM_SHA384 [RFC6209]
0xC05A TLS_DH_anon_WITH_ARIA_128_GCM_SHA256 [RFC6209]
0xC05B TLS_DH_anon_WITH_ARIA_256_GCM_SHA384 [RFC6209]
0xC05C TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256 [RFC6209]
0xC05D TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384 [RFC6209]
0xC05E TLS_ECDH_ECDSA_WITH_ARIA_128_GCM_SHA256 [RFC6209]
0xC05F TLS_ECDH_ECDSA_WITH_ARIA_256_GCM_SHA384 [RFC6209]
0xC060 TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256 [RFC6209]
0xC061 TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384 [RFC6209]
0xC062 TLS_ECDH_RSA_WITH_ARIA_128_GCM_SHA256 [RFC6209]
0xC063 TLS_ECDH_RSA_WITH_ARIA_256_GCM_SHA384 [RFC6209]
0xC064 TLS_PSK_WITH_ARIA_128_CBC_SHA256 [RFC6209]
0xC065 TLS_PSK_WITH_ARIA_256_CBC_SHA384 [RFC6209]
0xC066 TLS_DHE_PSK_WITH_ARIA_128_CBC_SHA256 [RFC6209]
0xC067 TLS_DHE_PSK_WITH_ARIA_256_CBC_SHA384 [RFC6209]
0xC068 TLS_RSA_PSK_WITH_ARIA_128_CBC_SHA256 [RFC6209]
0xC069 TLS_RSA_PSK_WITH_ARIA_256_CBC_SHA384 [RFC6209]
0xC06A TLS_PSK_WITH_ARIA_128_GCM_SHA256 [RFC6209]
0xC06B TLS_PSK_WITH_ARIA_256_GCM_SHA384 [RFC6209]
0xC06C TLS_DHE_PSK_WITH_ARIA_128_GCM_SHA256 [RFC6209]
0xC06D TLS_DHE_PSK_WITH_ARIA_256_GCM_SHA384 [RFC6209]
0xC06E TLS_RSA_PSK_WITH_ARIA_128_GCM_SHA256 [RFC6209]
0xC06F TLS_RSA_PSK_WITH_ARIA_256_GCM_SHA384 [RFC6209]
0xC070 TLS_ECDHE_PSK_WITH_ARIA_128_CBC_SHA256 [RFC6209]
0xC071 TLS_ECDHE_PSK_WITH_ARIA_256_CBC_SHA384 [RFC6209]
0xC072 TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 [RFC6367]
0xC073 TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 [RFC6367]
0xC074 TLS_ECDH_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 [RFC6367]
0xC075 TLS_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 [RFC6367]
0xC076 TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 [RFC6367]
0xC077 TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384 [RFC6367]
0xC078 TLS_ECDH_RSA_WITH_CAMELLIA_128_CBC_SHA256 [RFC6367]
0xC079 TLS_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384 [RFC6367]
0xC07A TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256 [RFC6367]
0xC07B TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384 [RFC6367]
0xC07C TLS_DHE_RSA_WITH_CAMELLIA_128_GCM_SHA256 [RFC6367]
0xC07D TLS_DHE_RSA_WITH_CAMELLIA_256_GCM_SHA384 [RFC6367]
0xC07E TLS_DH_RSA_WITH_CAMELLIA_128_GCM_SHA256 [RFC6367]
0xC07F TLS_DH_RSA_WITH_CAMELLIA_256_GCM_SHA384 [RFC6367]
0xC080 TLS_DHE_DSS_WITH_CAMELLIA_128_GCM_SHA256 [RFC6367]
0xC081 TLS_DHE_DSS_WITH_CAMELLIA_256_GCM_SHA384 [RFC6367]
0xC082 TLS_DH_DSS_WITH_CAMELLIA_128_GCM_SHA256 [RFC6367]
0xC083 TLS_DH_DSS_WITH_CAMELLIA_256_GCM_SHA384 [RFC6367]
0xC084 TLS_DH_anon_WITH_CAMELLIA_128_GCM_SHA256 [RFC6367]
0xC085 TLS_DH_anon_WITH_CAMELLIA_256_GCM_SHA384 [RFC6367]
0xC086 TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_GCM_SHA256 [RFC6367]
0xC087 TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_GCM_SHA384 [RFC6367]
0xC088 TLS_ECDH_ECDSA_WITH_CAMELLIA_128_GCM_SHA256 [RFC6367]
0xC089 TLS_ECDH_ECDSA_WITH_CAMELLIA_256_GCM_SHA384 [RFC6367]
0xC08A TLS_ECDHE_RSA_WITH_CAMELLIA_128_GCM_SHA256 [RFC6367]
0xC08B TLS_ECDHE_RSA_WITH_CAMELLIA_256_GCM_SHA384 [RFC6367]
0xC08C TLS_ECDH_RSA_WITH_CAMELLIA_128_GCM_SHA256 [RFC6367]
0xC08D TLS_ECDH_RSA_WITH_CAMELLIA_256_GCM_SHA384 [RFC6367]
0xC08E TLS_PSK_WITH_CAMELLIA_128_GCM_SHA256 [RFC6367]
0xC08F TLS_PSK_WITH_CAMELLIA_256_GCM_SHA384 [RFC6367]
0xC090 TLS_DHE_PSK_WITH_CAMELLIA_128_GCM_SHA256 [RFC6367]
0xC091 TLS_DHE_PSK_WITH_CAMELLIA_256_GCM_SHA384 [RFC6367]
0xC092 TLS_RSA_PSK_WITH_CAMELLIA_128_GCM_SHA256 [RFC6367]
0xC093 TLS_RSA_PSK_WITH_CAMELLIA_256_GCM_SHA384 [RFC6367]
0xC094 TLS_PSK_WITH_CAMELLIA_128_CBC_SHA256 [RFC6367]
0xC095 TLS_PSK_WITH_CAMELLIA_256_CBC_SHA384 [RFC6367]
0xC096 TLS_DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256 [RFC6367]
0xC097 TLS_DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384 [RFC6367]
0xC098 TLS_RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256 [RFC6367]
0xC099 TLS_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384 [RFC6367]
0xC09A TLS_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256 [RFC6367]
0xC09B TLS_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384 [RFC6367]
0xC09C TLS_RSA_WITH_AES_128_CCM [RFC6655]
0xC09D TLS_RSA_WITH_AES_256_CCM [RFC6655]
0xC09E TLS_DHE_RSA_WITH_AES_128_CCM [RFC6655]
0xC09F TLS_DHE_RSA_WITH_AES_256_CCM [RFC6655]
0xC0A0 TLS_RSA_WITH_AES_128_CCM_8 [RFC6655]
0xC0A1 TLS_RSA_WITH_AES_256_CCM_8 [RFC6655]
0xC0A2 TLS_DHE_RSA_WITH_AES_128_CCM_8 [RFC6655]
0xC0A3 TLS_DHE_RSA_WITH_AES_256_CCM_8 [RFC6655]
0xC0A4 TLS_PSK_WITH_AES_128_CCM [RFC6655]
0xC0A5 TLS_PSK_WITH_AES_256_CCM [RFC6655]
0xC0A6 TLS_DHE_PSK_WITH_AES_128_CCM [RFC6655]
0xC0A7 TLS_DHE_PSK_WITH_AES_256_CCM [RFC6655]
0xC0A8 TLS_PSK_WITH_AES_128_CCM_8 [RFC6655]
0xC0A9 TLS_PSK_WITH_AES_256_CCM_8 [RFC6655]
0xC0AA TLS_PSK_DHE_WITH_AES_128_CCM_8 [RFC6655]
0xC0AB TLS_PSK_DHE_WITH_AES_256_CCM_8 [RFC6655]
0xFEFE SSL_RSA_FIPS_WITH_DES_CBC_SHA http://www.mozilla.org/projects/security/pki/nss/ssl/fips-ssl-ciphersuites.html
0xFEFF SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA http://www.mozilla.org/projects/security/pki/nss/ssl/fips-ssl-ciphersuites.html
0xFFE0 SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA http://www.mozilla.org/projects/security/pki/nss/ssl/fips-ssl-ciphersuites.html
0xFFE1 SSL_RSA_FIPS_WITH_DES_CBC_SHA http://www.mozilla.org/projects/security/pki/nss/ssl/fips-ssl-ciphersuites.html
0xC0AC TLS_ECDHE_ECDSA_WITH_AES_128_CCM [RFC-mcgrew-tls-aes-ccm-ecc-08]
0xC0AD TLS_ECDHE_ECDSA_WITH_AES_256_CCM [RFC-mcgrew-tls-aes-ccm-ecc-08]
0xC0AE TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 [RFC-mcgrew-tls-aes-ccm-ecc-08]
0xC0AF TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8 [RFC-mcgrew-tls-aes-ccm-ecc-08]
#define TLS1_CK_RSA_EXPORT1024_WITH_RC4_56_MD5 0x03000060
#define TLS1_CK_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5 0x03000061
#define TLS1_CK_RSA_EXPORT1024_WITH_DES_CBC_SHA 0x03000062
#define TLS1_CK_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA 0x03000063
#define TLS1_CK_RSA_EXPORT1024_WITH_RC4_56_SHA 0x03000064
#define TLS1_CK_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA 0x03000065
#define TLS1_CK_DHE_DSS_WITH_RC4_128_SHA 0x03000066
#define TLS1_CK_RSA_WITH_AES_128_SHA 0x0300002F
#define TLS1_CK_DH_DSS_WITH_AES_128_SHA 0x03000030
#define TLS1_CK_DH_RSA_WITH_AES_128_SHA 0x03000031
#define TLS1_CK_DHE_DSS_WITH_AES_128_SHA 0x03000032
#define TLS1_CK_DHE_RSA_WITH_AES_128_SHA 0x03000033
#define TLS1_CK_ADH_WITH_AES_128_SHA 0x03000034
#define TLS1_CK_RSA_WITH_AES_256_SHA 0x03000035
#define TLS1_CK_DH_DSS_WITH_AES_256_SHA 0x03000036
#define TLS1_CK_DH_RSA_WITH_AES_256_SHA 0x03000037
#define TLS1_CK_DHE_DSS_WITH_AES_256_SHA 0x03000038
#define TLS1_CK_DHE_RSA_WITH_AES_256_SHA 0x03000039
#define TLS1_CK_ADH_WITH_AES_256_SHA 0x0300003A
#define TLS1_CK_RSA_WITH_CAMELLIA_128_CBC_SHA 0x03000041
#define TLS1_CK_DH_DSS_WITH_CAMELLIA_128_CBC_SHA 0x03000042
#define TLS1_CK_DH_RSA_WITH_CAMELLIA_128_CBC_SHA 0x03000043
#define TLS1_CK_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA 0x03000044
#define TLS1_CK_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA 0x03000045
#define TLS1_CK_ADH_WITH_CAMELLIA_128_CBC_SHA 0x03000046
#define TLS1_CK_RSA_WITH_CAMELLIA_256_CBC_SHA 0x03000084
#define TLS1_CK_DH_DSS_WITH_CAMELLIA_256_CBC_SHA 0x03000085
#define TLS1_CK_DH_RSA_WITH_CAMELLIA_256_CBC_SHA 0x03000086
#define TLS1_CK_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA 0x03000087
#define TLS1_CK_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA 0x03000088
#define TLS1_CK_ADH_WITH_CAMELLIA_256_CBC_SHA 0x03000089
#define TLS1_CK_RSA_WITH_SEED_SHA 0x03000096
#define TLS1_CK_DH_DSS_WITH_SEED_SHA 0x03000097
#define TLS1_CK_DH_RSA_WITH_SEED_SHA 0x03000098
#define TLS1_CK_DHE_DSS_WITH_SEED_SHA 0x03000099
#define TLS1_CK_DHE_RSA_WITH_SEED_SHA 0x0300009A
#define TLS1_CK_ADH_WITH_SEED_SHA 0x0300009B
#define TLS1_CK_ECDH_ECDSA_WITH_NULL_SHA 0x0300C001
#define TLS1_CK_ECDH_ECDSA_WITH_RC4_128_SHA 0x0300C002
#define TLS1_CK_ECDH_ECDSA_WITH_DES_192_CBC3_SHA 0x0300C003
#define TLS1_CK_ECDH_ECDSA_WITH_AES_128_CBC_SHA 0x0300C004
#define TLS1_CK_ECDH_ECDSA_WITH_AES_256_CBC_SHA 0x0300C005
#define TLS1_CK_ECDHE_ECDSA_WITH_NULL_SHA 0x0300C006
#define TLS1_CK_ECDHE_ECDSA_WITH_RC4_128_SHA 0x0300C007
#define TLS1_CK_ECDHE_ECDSA_WITH_DES_192_CBC3_SHA 0x0300C008
#define TLS1_CK_ECDHE_ECDSA_WITH_AES_128_CBC_SHA 0x0300C009
#define TLS1_CK_ECDHE_ECDSA_WITH_AES_256_CBC_SHA 0x0300C00A
#define TLS1_CK_ECDH_RSA_WITH_NULL_SHA 0x0300C00B
#define TLS1_CK_ECDH_RSA_WITH_RC4_128_SHA 0x0300C00C
#define TLS1_CK_ECDH_RSA_WITH_DES_192_CBC3_SHA 0x0300C00D
#define TLS1_CK_ECDH_RSA_WITH_AES_128_CBC_SHA 0x0300C00E
#define TLS1_CK_ECDH_RSA_WITH_AES_256_CBC_SHA 0x0300C00F
#define TLS1_CK_ECDHE_RSA_WITH_NULL_SHA 0x0300C010
#define TLS1_CK_ECDHE_RSA_WITH_RC4_128_SHA 0x0300C011
#define TLS1_CK_ECDHE_RSA_WITH_DES_192_CBC3_SHA 0x0300C012
#define TLS1_CK_ECDHE_RSA_WITH_AES_128_CBC_SHA 0x0300C013
#define TLS1_CK_ECDHE_RSA_WITH_AES_256_CBC_SHA 0x0300C014
#define TLS1_CK_ECDH_anon_WITH_NULL_SHA 0x0300C015
#define TLS1_CK_ECDH_anon_WITH_RC4_128_SHA 0x0300C016
#define TLS1_CK_ECDH_anon_WITH_DES_192_CBC3_SHA 0x0300C017
#define TLS1_CK_ECDH_anon_WITH_AES_128_CBC_SHA 0x0300C018
#define TLS1_CK_ECDH_anon_WITH_AES_256_CBC_SHA 0x0300C019
#define SSL3_CK_SCSV 0x030000FF
#define SSL3_CK_RSA_NULL_MD5 0x03000001
#define SSL3_CK_RSA_NULL_SHA 0x03000002
#define SSL3_CK_RSA_RC4_40_MD5 0x03000003
#define SSL3_CK_RSA_RC4_128_MD5 0x03000004
#define SSL3_CK_RSA_RC4_128_SHA 0x03000005
#define SSL3_CK_RSA_RC2_40_MD5 0x03000006
#define SSL3_CK_RSA_IDEA_128_SHA 0x03000007
#define SSL3_CK_RSA_DES_40_CBC_SHA 0x03000008
#define SSL3_CK_RSA_DES_64_CBC_SHA 0x03000009
#define SSL3_CK_RSA_DES_192_CBC3_SHA 0x0300000A
#define SSL3_CK_DH_DSS_DES_40_CBC_SHA 0x0300000B
#define SSL3_CK_DH_DSS_DES_64_CBC_SHA 0x0300000C
#define SSL3_CK_DH_DSS_DES_192_CBC3_SHA 0x0300000D
#define SSL3_CK_DH_RSA_DES_40_CBC_SHA 0x0300000E
#define SSL3_CK_DH_RSA_DES_64_CBC_SHA 0x0300000F
#define SSL3_CK_DH_RSA_DES_192_CBC3_SHA 0x03000010
#define SSL3_CK_EDH_DSS_DES_40_CBC_SHA 0x03000011
#define SSL3_CK_EDH_DSS_DES_64_CBC_SHA 0x03000012
#define SSL3_CK_EDH_DSS_DES_192_CBC3_SHA 0x03000013
#define SSL3_CK_EDH_RSA_DES_40_CBC_SHA 0x03000014
#define SSL3_CK_EDH_RSA_DES_64_CBC_SHA 0x03000015
#define SSL3_CK_EDH_DSS_DES_40_CBC_SHA 0x03000011
#define SSL3_CK_EDH_DSS_DES_64_CBC_SHA 0x03000012
#define SSL3_CK_EDH_DSS_DES_192_CBC3_SHA 0x03000013
#define SSL3_CK_EDH_RSA_DES_40_CBC_SHA 0x03000014
#define SSL3_CK_EDH_RSA_DES_64_CBC_SHA 0x03000015
#define SSL3_CK_EDH_RSA_DES_192_CBC3_SHA 0x03000016
#define SSL3_CK_ADH_RC4_40_MD5 0x03000017
#define SSL3_CK_ADH_RC4_128_MD5 0x03000018
#define SSL3_CK_ADH_DES_40_CBC_SHA 0x03000019
#define SSL3_CK_ADH_DES_64_CBC_SHA 0x0300001A
#define SSL3_CK_ADH_DES_192_CBC_SHA 0x0300001B
#define SSL3_CK_FZA_DMS_NULL_SHA 0x0300001C
#define SSL3_CK_FZA_DMS_FZA_SHA 0x0300001D
#define SSL3_CK_FZA_DMS_RC4_SHA 0x0300001E
#define SSL3_CK_KRB5_DES_64_CBC_SHA 0x0300001E
#define SSL3_CK_KRB5_DES_192_CBC3_SHA 0x0300001F
#define SSL3_CK_KRB5_RC4_128_SHA 0x03000020
#define SSL3_CK_KRB5_IDEA_128_CBC_SHA 0x03000021
#define SSL3_CK_KRB5_DES_64_CBC_MD5 0x03000022
#define SSL3_CK_KRB5_DES_192_CBC3_MD5 0x03000023
#define SSL3_CK_KRB5_RC4_128_MD5 0x03000024
#define SSL3_CK_KRB5_IDEA_128_CBC_MD5 0x03000025
#define SSL3_CK_KRB5_DES_40_CBC_SHA 0x03000026
#define SSL3_CK_KRB5_RC2_40_CBC_SHA 0x03000027
#define SSL3_CK_KRB5_RC4_40_SHA 0x03000028
#define SSL3_CK_KRB5_DES_40_CBC_MD5 0x03000029
#define SSL3_CK_KRB5_RC2_40_CBC_MD5 0x0300002A
#define SSL3_CK_KRB5_RC4_40_MD5 0x0300002B
#define SSL2_CK_NULL_WITH_MD5 0x02000000 /* v3 */
#define SSL2_CK_RC4_128_WITH_MD5 0x02010080
#define SSL2_CK_RC4_128_EXPORT40_WITH_MD5 0x02020080
#define SSL2_CK_RC2_128_CBC_WITH_MD5 0x02030080
#define SSL2_CK_RC2_128_CBC_EXPORT40_WITH_MD5 0x02040080
#define SSL2_CK_IDEA_128_CBC_WITH_MD5 0x02050080
#define SSL2_CK_DES_64_CBC_WITH_MD5 0x02060040
#define SSL2_CK_DES_64_CBC_WITH_SHA 0x02060140 /* v3 */
#define SSL2_CK_DES_192_EDE3_CBC_WITH_MD5 0x020700c0
#define SSL2_CK_DES_192_EDE3_CBC_WITH_SHA 0x020701c0 /* v3 */
#define SSL2_CK_RC4_64_WITH_MD5 0x02080080 /* MS hack */
#define SSL2_CK_DES_64_CFB64_WITH_MD5_1 0x02ff0800 /* SSLeay */
#define SSL2_CK_NULL 0x02ff0810 /* SSLeay */
";
my %nameofcc;
my %numberofcc;
foreach my $line (split "\n", $ciphersuitenamestring) {
if ($line =~ /(?:SSL3|TLS1)_CK_(\S+)\s+0x0300([0-9A-Fa-f]{4})/) {
$nameofcc{$2} = $1;
$numberofcc{$1} = $2;
}
if ($line =~ /SSL2_CK_(\S+)\s+0x02([0-9A-Fa-f]{6})/) {
$nameofcc{uc $2} = $1;
$numberofcc{$1} = uc $2;
}
# 0x002F TLS_RSA_WITH_AES_128_CBC_SHA [RFC5246]
if ($line =~ /^0x([0-9a-fA-F]{4})\s+(?:SSL|TLS)_(\S+)/) {
$nameofcc{uc $1} = $2;
$numberofcc{$2} = uc $1;
}
}
# flush after every write
$| = 1;
my $global_starttime = time;
printf "Starting ssl-cipher-suite-enum v%s ( http://labs.portcullis.co.uk/application/ssl-cipher-suite-enum/ ) at %s\n", $VERSION, scalar(localtime);
printf "\n[+] Scanning %s hosts\n", scalar @targets;
print Dumper \@targets if $debug > 0;
foreach my $target_href (@targets) {
%results = ();
scan_host($target_href->{hostname}, $target_href->{ip}, $target_href->{port});
}
print_section("Scan Complete");
printf "[+] ssl-cipher-suite-enum v%s completed at %s. %s connections in %s secs.\n", $VERSION, scalar(localtime), $global_connection_count, get_runtime();
print "\n";
sub scan_host {
my ($host, $ip, $port) = @_;
print_section("Scan Info");
print "Target: $host\n";
print "IP: $ip\n";
print "Port: $port\n";
print "Protocols: $protos_to_test\n";
print "Persist: $global_persist\n";
printf "Preamble: %s%s%s%s%s\n", $global_mysql ? "MySQL" : "", $global_ftp ? "FTP" : "", $global_rdp ? "RDP" : "", $global_smtp ? "SMTP" : "", ($global_rdp == 0 and $global_smtp == 0 and $global_ftp == 0 and $global_mysql == 0) ? "None" : "";
printf "Scan Rate: %s\n", defined($global_rate) ? $global_rate . " connections/sec" : "unlimited";
printf "Recv Timeout: %s\n", $global_recv_timeout;
$global_connection_count = 0; # need to reset for each host for accurate scan rate
protocol: foreach my $protocol (@protos_to_test) {
my $protocol_name = get_protocol_name($protocol);
print_section("Testing protocol $protocol_name");
my $cc_supported = 0;
my @supported_ciphersuites = ();
my $some_beast = 0;
my $some_poodle = 0;
my $most_beast = 0;
my $some_nofs = 0;
my $most_nofs = 0;
my $null_encryption = 0;
my $weak_encryption = 0;
my $some_logjam = 0;
my $some_freak = 0;
my $meet_middle = 0;
my $anon_dh = 0;
my $bias = 0;
if ($protocol eq "0200") {
foreach my $ciphersuite (qw(000000 010080 020080 030080 040080 050080 060040 060140 0700c0 0701c0 080080 ff0800 ff0810 0000ff)) {
my $supported = test_v2_ciphersuites($ip, $port, $protocol, $ciphersuite);
if (length($supported) == 6) {
push @supported_ciphersuites, $supported;
if ($supported eq $ciphersuite) {
printf "[+] Cipher suite supported on $ip:$port: %s %s %s\n", get_protocol_name($protocol), get_cc_name($supported), get_warnings($protocol, $supported);
$cc_supported++;
} else {
printf "[!] Cipher suite supported on $ip:$port: %s %s, Probed for: %s %s\n", get_protocol_name($protocol), get_cc_name($supported), get_cc_name($ciphersuite), get_warnings($protocol, $supported);
}
my @warnings = get_warnings_array($protocol, $supported);
foreach my $warning (@warnings) {
$results{$warning} = {} unless defined($results{$warning});
$results{$warning}{$protocol} = {} unless defined($results{$warning}{$protocol});
$results{$warning}{$protocol}{$supported} = 1;
}
$results{"SUPPORTED"}->{$protocol}->{$supported} = 1;
if (vuln_to_beast($protocol, $supported)) {
$some_beast = 1;
}
if (vuln_to_poodle($protocol, $supported)) {
$some_poodle = 1;
}
if (uses_forward_secrecy($protocol, $supported)) {
$some_nofs = 1;
}
if (uses_null_cipher($supported)) {
$null_encryption = 1;
}
if (uses_weak_cipher($supported)) {
$weak_encryption = 1;
}
if (vuln_to_logjam($supported)) {
$some_logjam = 1;
}
if (vuln_to_freak($supported)) {
$some_freak = 1;
}
if (uses_3des($supported)) {
$meet_middle = 1;
}
if (uses_anon_dh($protocol, $supported)) {
$anon_dh = 1;
}
if (uses_RC4($protocol, $supported)) {
$bias = 1;
}
# Some servers close connection when an unsupported cipher suite is encountered
# Some reply
# And some do both, so we need to check again here in case we get a reply
}
}
} else {
my @cc_todo_individually = ();
my @cc_todo_in_groups = ();
# Put the rarely-supported cipher suites into one group
# and the more commonly supported ones into another
foreach my $ciphersuite (map {sprintf("00%02x", $_), sprintf("c0%02x", $_); } (0..255)) {
my $cc_name = get_cc_name($ciphersuite);
if ($cc_name =~ /(UNKNOWN|PSK|GOST|KRB|NULL|anon|FZA|ADH)/) {
push @cc_todo_in_groups, $ciphersuite;
} else {
push @cc_todo_individually, $ciphersuite;
}
}
my $cc_chunk_size = 10;
my $protocol_supported = 1;
ciphersuite: while (scalar @cc_todo_in_groups) {
my @cc_chunk = splice(@cc_todo_in_groups, 0, $cc_chunk_size);
if (scalar @cc_chunk) {
my $supported = test_v3_ciphersuites($ip, $port, $protocol, @cc_chunk);
if (length($supported) == 4) {
# one or more is valid. so we try individually instead later
push @cc_todo_individually, @cc_chunk;
} elsif ($supported == -2) {
$protocol_supported = 0;
unless ($global_persist) {
last ciphersuite;
}
} elsif ($supported == -1) {
# none are valid. we saved time by not trying individually
} else {
print "[W] Unexpected result from test_v3_ciphersuites()\n";
}
}
}
if ($protocol_supported or $global_persist) {
ciphersuite: foreach my $ciphersuite (@cc_todo_individually) {
my $supported = test_v3_ciphersuites($ip, $port, $protocol, $ciphersuite);
if (length($supported) == 4) {
$cc_supported++;
push @supported_ciphersuites, $supported;
my @warnings = get_warnings_array($protocol, $supported);
foreach my $warning (@warnings) {
$results{$warning} = {} unless defined($results{$warning});
$results{$warning}{$protocol} = {} unless defined($results{$warning}{$protocol});
$results{$warning}{$protocol}{$supported} = 1;
}
$results{"SUPPORTED"}->{$protocol}->{$supported} = 1;
if ($supported eq $ciphersuite) {
printf "[+] Cipher suite supported on $ip:$port: %s %s %s\n", get_protocol_name($protocol), get_cc_name($supported), get_warnings($protocol, $supported);
} else {
printf "[!] Cipher suite supported on $ip:$port: %s %s, Probed for: %s %s\n", get_protocol_name($protocol), get_cc_name($supported), get_cc_name($ciphersuite), get_warnings($protocol, $supported);
}
if (vuln_to_beast($protocol, $supported)) {
$some_beast = 1;
}
if (vuln_to_poodle($protocol, $supported)) {
$some_poodle = 1;
}
if (uses_forward_secrecy($protocol, $supported)) {
$some_nofs = 1;
}
if (uses_null_cipher($supported)) {
$null_encryption = 1;
}
if (uses_weak_cipher($supported)) {
$weak_encryption = 1;
}
if (vuln_to_logjam($supported)) {
$some_logjam = 1;
}
if (vuln_to_freak($supported)) {
$some_freak = 1;
}
if (uses_3des($supported)) {
$meet_middle = 1;
}
if (uses_anon_dh($protocol, $supported)) {
$anon_dh = 1;
}
if (uses_RC4($protocol, $supported)) {
$bias = 1;
}
# Some servers close connection when an unsupported cipher suite is encountered
# Some reply
# And some do both, so we need to check again here in case we get a reply
} elsif ($supported == -2) {
$protocol_supported = 0;
unless ($global_persist) {
last ciphersuite;
}
}
}
}
}
if (scalar @supported_ciphersuites and $protocol ne "0200") {
# Check perferred cipher suite
my $supported;
$supported = test_v3_ciphersuites($ip, $port, $protocol, @supported_ciphersuites);
if (length($supported) == 4) {
printf "\n[+] Preferred %s cipher suite on $ip:$port: %s %s\n\n", get_protocol_name($protocol), get_cc_name($supported), get_warnings($protocol, $supported);
if (vuln_to_beast($protocol, $supported)) {
$most_beast = 1;
}
unless (uses_forward_secrecy($protocol, $supported)) {
$most_nofs = 1;
}
} elsif ($supported == -1) {
print "\n[W] Preffered cipher suite not found on $ip:$port. This shouldn't happen!\n";
}
}
printf "[+] %s %s cipher suites supported\n", $cc_supported, get_protocol_name($protocol);
print "\n";
if ($most_beast) {
print "[V] $ip:$port - Most clients will be vulnerable to BEAST attack - if HTTPS service\n";
} elsif ($some_beast) {
print "[V] $ip:$port - Some clients could be vulnerable to BEAST attack - if HTTPS service\n";
}
if ($some_poodle) {
print "[V] $ip:$port - Some clients could be vulnerable to POODLE attack\n";
}
if ($weak_encryption) {
print "[V] $ip:$port - Some connections might be protected with a weak (<128-bit) symmetric encryption key\n";
}
if ($null_encryption) {
print "[V] $ip:$port - Some connections might not be encrypted (NULL encryption cipher)\n";
}
if ($anon_dh) {
print "[V] $ip:$port - Server supports a key-exchange algorithm that is vulnerable to man-in-the-middle attack (anonymous Diffie Hellman)\n";
}
if ($some_logjam) {
print "[V] $ip:$port - Some connections could be vulnerable to LOGJAM attack\n";
}
if ($some_freak) {
print "[V] $ip:$port - Some connections could be vulnerable to FREAK attack\n";
}
if ($meet_middle) {
print "[V] $ip:$port - 3DES vulnerable to Meet in the Middle Attacks\n";
}
if ($bias) {
print "[V] $ip:$port - RC4-based SSL Cipher Suites Vulnerable To Bias Attacks\n";
}
if ($most_nofs) {
print "[V] $ip:$port - Most encrypted connections will not use forward secrecy\n";
} elsif ($some_nofs) {
print "[V] $ip:$port - Some encrypted connections may not have forward secrecy\n";
}
# TODO: sslv2 reneg dos, reneg mitm
}
# Print out human-readable summary
print "[+] Summary of support cipher suites for $ip:$port\n\n";
foreach my $proto (sort keys(%{$results{"SUPPORTED"}})) {
printf "%s:\n", get_protocol_name($proto);
if (scalar keys(%{$results{"SUPPORTED"}{$proto}}) == 0) {
print "* None\n";
} else {
foreach my $cc (sort keys(%{$results{"SUPPORTED"}{$proto}})) {
printf "* %s\n", get_cc_name_pretty($cc);
}
}
print "\n";
}
foreach my $section (sort keys(%results)) {
next if $section eq "SUPPORTED";
print "[+] Summary of weakness \"$section\" for $ip:$port\n\n";
foreach my $proto (sort keys(%{$results{$section}})) {
printf "%s:\n", get_protocol_name($proto);
if (scalar keys(%{$results{$section}{$proto}}) == 0) {
print "* None\n";
} else {
foreach my $cc (sort keys(%{$results{$section}{$proto}})) {
printf "* %s\n", get_cc_name_pretty($cc);
}
}
print "\n";
}
}
print Dumper \%results if $debug;
}
sub get_cc_name_pretty {
my ($ciphersuite) = @_; # in hex
my $ccname = "UNKNOWN_CIPHER_SUITE_NAME [$ciphersuite]";
if (defined($nameofcc{uc $ciphersuite})) {
$ccname = $nameofcc{uc $ciphersuite};
}
return $ccname;
}