diff --git a/sslchecker b/sslchecker index 9f29800..db8873b 100644 --- a/sslchecker +++ b/sslchecker @@ -67,34 +67,20 @@ LocalCheck() RemoteCheck() { - echo | openssl s_client -connect $host:$port -servername $host 2>/dev/null | openssl x509 -noout -text -certopt no_header,no_version,no_serial,no_signame,no_pubkey,no_sigdump,no_aux + nmap --script ssl-cert -p $port $host -oX - | xmlstarlet sel -t -m '/nmaprun/host/ports/port' -o "CA=\"" -v 'script/table/elem[@key="organizationName"]' -o "\"" -o $'\n' -o "BEGINN=\"" -v 'script/table/elem[@key="notBefore"]' -o "\"" -o $'\n' -o "ENDING=\"" -v 'script/table/elem[@key="notAfter"]' -o "\"" -o $'\n' -o "DOMAINS=\"" -v 'script/table/table[elem="X509v3 Subject Alternative Name"]/elem[@key="value"]' -o "\"" -n - | sed -e 's/DNS://g' } -AltName() -{ -grep -A1 "Subject Alternative Name:" | tail -n1 | sed 's/\*/wildcard/g' | sed 's/DNS://g' | tr -d ' ' | tr ',' '\n' -} - -Validation() -{ - grep "CN =" | grep "Issuer" | sed 's/^.*CN = //g' -} - -ValidDate() -{ - grep "Not" | sed 's/^[^:]*: //g' -} Records() { ipv4s=`dig +short A $host` ipv6s=`dig +short AAAA $host` for ipv4 in $ipv4s; do - echo -e "A: \t ${ipv4} \t PTR: `dig +short -x ${ipv4}`" + echo -e " A: \t ${ipv4} \t PTR: `dig +short -x ${ipv4}`" done; for ipv6 in $ipv6s; do - echo -e "AAAA: \t ${ipv6} \t PTR: `dig +short -x ${ipv6}`" + echo -e " AAAA: \t ${ipv6} \t PTR: `dig +short -x ${ipv6}`" done; } if [[ "$source" == "local" ]]; then @@ -109,12 +95,15 @@ if [ -z "$port" ]; then port="443" fi +source <(RemoteCheck) + echo -e '\e[90m\e[1m\e[104mCert is valid for:\e[0m' -RemoteCheck | AltName +echo \ $DOMAINS | sed 's/,/\n/g' echo -e '\e[90m\e[1m\e[101mValidated by:\e[0m' -RemoteCheck | Validation +echo \ $CA echo -e '\e[90m\e[1m\e[43mValidated from to:\e[0m' -RemoteCheck | ValidDate +echo \ $BEGINN +echo \ $ENDING echo -e '\e[90m\e[1m\e[102mIP and Reverse Lookups:\e[0m' Records fi @@ -125,13 +114,13 @@ if [ "$source" == "update" ]; then fi if [ "$source" == "version" ]; then - echo "Version 2021-09-28" + echo "Version 2021-10-29" fi if [ "$source" == "cipher" ]; then if [ -z "$port" ]; then port="443" fi - - nmap --script ssl-enum-ciphers -p $port $host -fi \ No newline at end of file +echo -e '\e[90m\e[1m\e[104mTLS Version | Cipher | Kex \e[0m' + nmap --script ssl-enum-ciphers -p $port $host -oX - | xmlstarlet sel -t -m '//nmaprun/host/ports/port/script/table/table/table' -v '../../@key' -o " | " -v 'elem[@key="name"]' -o ' | ' -v 'elem[@key="kex_info"]' -n +fi