当前位置:   article > 正文

快速扫描服务端口来获取服务器支持的SSL cipher列表_探测到服务器支持的ssl加密协议

探测到服务器支持的ssl加密协议

出于安全考虑,网络上的数据传输大部分都是加密传输。我们平时接触到比较多的应该算是https了。HTTPS是在HTTP的基础上通过SSL协议对数据进行加密,以保证用户数据在传输过程中不被窃取。

SSL协议有sslv2, sslv3, tlsv1, tlsv1.1和tlsv1.2。目前推荐使用的只有tlsv1.2,其它协议都存在各种安全漏洞。在每种SSL协议中,又包括了一系列的加密算法,也即是ciphers suite。即使是tlsv1.2的cipher suite,也包含了一些比较弱的加密算法。通常我们需要在服务器端禁止这些cipher。

那我们如何检查我们的服务器是否有安全漏洞,是否支持带安全隐患的SSL协议或者cipher呢?你可以检查服务器的配置,不过如果服务器的数量比较多,这会是一个很繁重的工作,而且不同类型的服务器配置的方法,语法不一,检查起来也不方便。网络上也有一些商业的或者免费的扫描工具可以直接使用。但如果你的服务器只对内网开放,就只能使用内网环境下的工具扫描了。

最简单的方法就是通过openssl s_client命令去检查服务端口,比如

  1. openssl s_client -connect host:port -ssl3
  2. openssl s_client -cipher ECDHE-ECDSA-AES256-GCM-SHA384 -connect host:port

嫌手动麻烦的话可以使用脚本,如下面这个脚本可以用来扫描服务器支持或不支持的cipher(引用自点击打开链接)

  1. #!/usr/bin/env bash
  2. # 运行方式:./scanServerCiphers.sh host:port
  3. # OpenSSL requires the port number.
  4. SERVER=$1
  5. DELAY=1
  6. ciphers=$(openssl ciphers 'ALL:eNULL' | sed -e 's/:/ /g')
  7. echo Obtaining cipher list from $(openssl version).
  8. for cipher in ${ciphers[@]}
  9. do
  10. echo -n Testing $cipher...
  11. result=$(echo -n | openssl s_client -cipher "$cipher" -connect $SERVER 2>&1)
  12. if [[ "$result" =~ ":error:" ]] ; then
  13. error=$(echo -n $result | cut -d':' -f6)
  14. echo NO \($error\)
  15. else
  16. if [[ "$result" =~ "Cipher is ${cipher}" || "$result" =~ "Cipher :" ]] ; then
  17. echo YES
  18. else
  19. echo UNKNOWN RESPONSE
  20. echo $result
  21. fi
  22. fi
  23. sleep $DELAY

不过用这种方式去枚举每一种cipher实在是太耗时了,扫描单台服务器单个端口的速度我都接受不了。

噔噔噔噔,下面另一个工具--sslyze闪亮登场。。。

源码可以在这里下载。最新版本支持pythone 2.7和3.4+,不过有太多依赖包,我选择了比较旧的版本,只支持python 2.7 -->点击打开链接,此版本的requirements.txt貌似写错了,安装之后无法运行,我把它修改成"nassl>=0.13.0,<0.14.0"后可以正常使用。

下面讲一下如何安装和使用。

我是在Linux上使用的,需要安装python-devel

yum install python-devel.x86_64

然后是安装依赖包,此处需要修改一下requirements.txt (上文已有阐述)。不知道pip的请自行百度。

pip install -r requirements.txt

然后就可以直接运行了。

  1. $ python sslyze_cli.py --tlsv1_2 www.baidu.com:443
  2. AVAILABLE PLUGINS
  3. -----------------
  4. FallbackScsvPlugin
  5. OpenSslCipherSuitesPlugin
  6. SessionResumptionPlugin
  7. HstsPlugin
  8. CertificateInfoPlugin
  9. CompressionPlugin
  10. OpenSslCcsInjectionPlugin
  11. SessionRenegotiationPlugin
  12. HeartbleedPlugin
  13. CHECKING HOST(S) AVAILABILITY
  14. -----------------------------
  15. www.baidu.com:443 => 14.215.177.39
  16. SCAN RESULTS FOR WWW.BAIDU.COM:443 - 14.215.177.39:443
  17. ------------------------------------------------------
  18. * TLSV1_2 Cipher Suites:
  19. Preferred:
  20. TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 ECDH-256 bits 128 bits
  21. Accepted:
  22. TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA ECDH-256 bits 256 bits
  23. TLS_RSA_WITH_AES_256_CBC_SHA - 256 bits
  24. TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 ECDH-256 bits 128 bits
  25. TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA ECDH-256 bits 128 bits
  26. TLS_RSA_WITH_AES_128_CBC_SHA - 128 bits
  27. TLS_ECDHE_RSA_WITH_RC4_128_SHA ECDH-256 bits 128 bits
  28. TLS_RSA_WITH_RC4_128_SHA - 128 bits
  29. Rejected:
  30. TLS_SRP_SHA_WITH_AES_256_CBC_SHA TLS / No ciphers available
  31. TLS_SRP_SHA_WITH_AES_128_CBC_SHA TLS / No ciphers available
  32. TLS_SRP_SHA_WITH_3DES_EDE_CBC_SHA TLS / No ciphers available
  33. TLS_SRP_SHA_RSA_WITH_AES_256_CBC_SHA TLS / No ciphers available
  34. TLS_SRP_SHA_RSA_WITH_AES_128_CBC_SHA TLS / No ciphers available
  35. TLS_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA TLS / No ciphers available
  36. TLS_SRP_SHA_DSS_WITH_AES_256_CBC_SHA TLS / No ciphers available
  37. TLS_SRP_SHA_DSS_WITH_AES_128_CBC_SHA TLS / No ciphers available
  38. TLS_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA TLS / No ciphers available
  39. TLS_RSA_WITH_SEED_CBC_SHA TLS / Alert handshake failure
  40. TLS_RSA_WITH_RC4_128_MD5 TLS / Alert handshake failure
  41. TLS_RSA_WITH_NULL_SHA256 TLS / Alert handshake failure
  42. TLS_RSA_WITH_NULL_SHA TLS / Alert handshake failure
  43. TLS_RSA_WITH_NULL_MD5 TLS / Alert handshake failure
  44. TLS_RSA_WITH_IDEA_CBC_SHA TLS / Alert handshake failure
  45. TLS_RSA_WITH_DES_CBC_SHA TLS / Alert handshake failure
  46. TLS_RSA_WITH_CAMELLIA_256_CBC_SHA TLS / Alert handshake failure
  47. TLS_RSA_WITH_CAMELLIA_128_CBC_SHA TLS / Alert handshake failure
  48. TLS_RSA_WITH_AES_256_GCM_SHA384 TLS / Alert handshake failure
  49. TLS_RSA_WITH_AES_256_CBC_SHA256 TLS / Alert handshake failure
  50. TLS_RSA_WITH_AES_128_GCM_SHA256 TLS / Alert handshake failure
  51. TLS_RSA_WITH_AES_128_CBC_SHA256 TLS / Alert handshake failure
  52. TLS_RSA_WITH_3DES_EDE_CBC_SHA TLS / Alert handshake failure
  53. TLS_RSA_EXPORT_WITH_RC4_40_MD5 TLS / Alert handshake failure
  54. TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5 TLS / Alert handshake failure
  55. TLS_RSA_EXPORT_WITH_DES40_CBC_SHA TLS / Alert handshake failure
  56. TLS_RSA_EXPORT1024_WITH_RC4_56_SHA TLS / Alert handshake failure
  57. TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA TLS / Alert handshake failure
  58. TLS_PSK_WITH_RC4_128_SHA TLS / No ciphers available
  59. TLS_PSK_WITH_AES_256_CBC_SHA TLS / No ciphers available
  60. TLS_PSK_WITH_AES_128_CBC_SHA TLS / No ciphers available
  61. TLS_PSK_WITH_3DES_EDE_CBC_SHA TLS / No ciphers available
  62. TLS_ECDH_anon_WITH_RC4_128_SHA TLS / Alert handshake failure
  63. TLS_ECDH_anon_WITH_NULL_SHA TLS / Alert handshake failure
  64. TLS_ECDH_anon_WITH_AES_256_CBC_SHA TLS / Alert handshake failure
  65. TLS_ECDH_anon_WITH_AES_128_CBC_SHA TLS / Alert handshake failure
  66. TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA TLS / Alert handshake failure
  67. TLS_ECDH_RSA_WITH_RC4_128_SHA TLS / Alert handshake failure
  68. TLS_ECDH_RSA_WITH_NULL_SHA TLS / Alert handshake failure
  69. TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384 TLS / Alert handshake failure
  70. TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384 TLS / Alert handshake failure
  71. TLS_ECDH_RSA_WITH_AES_256_CBC_SHA TLS / Alert handshake failure
  72. TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256 TLS / Alert handshake failure
  73. TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256 TLS / Alert handshake failure
  74. TLS_ECDH_RSA_WITH_AES_128_CBC_SHA TLS / Alert handshake failure
  75. TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA TLS / Alert handshake failure
  76. TLS_ECDH_ECDSA_WITH_RC4_128_SHA TLS / Alert handshake failure
  77. TLS_ECDH_ECDSA_WITH_NULL_SHA TLS / Alert handshake failure
  78. TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384 TLS / Alert handshake failure
  79. TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384 TLS / Alert handshake failure
  80. TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA TLS / Alert handshake failure
  81. TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 TLS / Alert handshake failure
  82. TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256 TLS / Alert handshake failure
  83. TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA TLS / Alert handshake failure
  84. TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA TLS / Alert handshake failure
  85. TLS_ECDHE_RSA_WITH_NULL_SHA TLS / Alert handshake failure
  86. TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 TLS / Alert handshake failure
  87. TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 TLS / Alert handshake failure
  88. TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 TLS / Alert handshake failure
  89. TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 TLS / Alert handshake failure
  90. TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA TLS / Alert handshake failure
  91. TLS_ECDHE_ECDSA_WITH_RC4_128_SHA TLS / Alert handshake failure
  92. TLS_ECDHE_ECDSA_WITH_NULL_SHA TLS / Alert handshake failure
  93. TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 TLS / Alert handshake failure
  94. TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 TLS / Alert handshake failure
  95. TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 TLS / Alert handshake failure
  96. TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA TLS / Alert handshake failure
  97. TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 TLS / Alert handshake failure
  98. TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 TLS / Alert handshake failure
  99. TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA TLS / Alert handshake failure
  100. TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA TLS / Alert handshake failure
  101. TLS_DH_anon_WITH_SEED_CBC_SHA TLS / Alert handshake failure
  102. TLS_DH_anon_WITH_RC4_128_MD5 TLS / Alert handshake failure
  103. TLS_DH_anon_WITH_DES_CBC_SHA TLS / Alert handshake failure
  104. TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA TLS / Alert handshake failure
  105. TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA TLS / Alert handshake failure
  106. TLS_DH_anon_WITH_AES_256_GCM_SHA384 TLS / Alert handshake failure
  107. TLS_DH_anon_WITH_AES_256_CBC_SHA256 TLS / Alert handshake failure
  108. TLS_DH_anon_WITH_AES_256_CBC_SHA TLS / Alert handshake failure
  109. TLS_DH_anon_WITH_AES_128_GCM_SHA256 TLS / Alert handshake failure
  110. TLS_DH_anon_WITH_AES_128_CBC_SHA256 TLS / Alert handshake failure
  111. TLS_DH_anon_WITH_AES_128_CBC_SHA TLS / Alert handshake failure
  112. TLS_DH_anon_WITH_3DES_EDE_CBC_SHA TLS / Alert handshake failure
  113. TLS_DH_anon_EXPORT_WITH_RC4_40_MD5 TLS / Alert handshake failure
  114. TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA TLS / Alert handshake failure
  115. TLS_DH_RSA_WITH_SEED_CBC_SHA TLS / Alert handshake failure
  116. TLS_DH_RSA_WITH_DES_CBC_SHA TLS / Alert handshake failure
  117. TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA TLS / Alert handshake failure
  118. TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA TLS / Alert handshake failure
  119. TLS_DH_RSA_WITH_AES_256_GCM_SHA384 TLS / Alert handshake failure
  120. TLS_DH_RSA_WITH_AES_256_CBC_SHA256 TLS / Alert handshake failure
  121. TLS_DH_RSA_WITH_AES_256_CBC_SHA TLS / Alert handshake failure
  122. TLS_DH_RSA_WITH_AES_128_GCM_SHA256 TLS / Alert handshake failure
  123. TLS_DH_RSA_WITH_AES_128_CBC_SHA256 TLS / Alert handshake failure
  124. TLS_DH_RSA_WITH_AES_128_CBC_SHA TLS / Alert handshake failure
  125. TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA TLS / Alert handshake failure
  126. TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA TLS / Alert handshake failure
  127. TLS_DH_DSS_WITH_SEED_CBC_SHA TLS / Alert handshake failure
  128. TLS_DH_DSS_WITH_DES_CBC_SHA TLS / Alert handshake failure
  129. TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA TLS / Alert handshake failure
  130. TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA TLS / Alert handshake failure
  131. TLS_DH_DSS_WITH_AES_256_GCM_SHA384 TLS / Alert handshake failure
  132. TLS_DH_DSS_WITH_AES_256_CBC_SHA256 TLS / Alert handshake failure
  133. TLS_DH_DSS_WITH_AES_256_CBC_SHA TLS / Alert handshake failure
  134. TLS_DH_DSS_WITH_AES_128_GCM_SHA256 TLS / Alert handshake failure
  135. TLS_DH_DSS_WITH_AES_128_CBC_SHA256 TLS / Alert handshake failure
  136. TLS_DH_DSS_WITH_AES_128_CBC_SHA TLS / Alert handshake failure
  137. TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA TLS / Alert handshake failure
  138. TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA TLS / Alert handshake failure
  139. TLS_DHE_RSA_WITH_SEED_CBC_SHA TLS / Alert handshake failure
  140. TLS_DHE_RSA_WITH_DES_CBC_SHA TLS / Alert handshake failure
  141. TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 TLS / Alert handshake failure
  142. TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA TLS / Alert handshake failure
  143. TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA TLS / Alert handshake failure
  144. TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 TLS / Alert handshake failure
  145. TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 TLS / Alert handshake failure
  146. TLS_DHE_RSA_WITH_AES_256_CBC_SHA TLS / Alert handshake failure
  147. TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 TLS / Alert handshake failure
  148. TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 TLS / Alert handshake failure
  149. TLS_DHE_RSA_WITH_AES_128_CBC_SHA TLS / Alert handshake failure
  150. TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA TLS / Alert handshake failure
  151. TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA TLS / Alert handshake failure
  152. TLS_DHE_DSS_WITH_SEED_CBC_SHA TLS / Alert handshake failure
  153. TLS_DHE_DSS_WITH_RC4_128_SHA TLS / Alert handshake failure
  154. TLS_DHE_DSS_WITH_DES_CBC_SHA TLS / Alert handshake failure
  155. TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA TLS / Alert handshake failure
  156. TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA TLS / Alert handshake failure
  157. TLS_DHE_DSS_WITH_AES_256_GCM_SHA384 TLS / Alert handshake failure
  158. TLS_DHE_DSS_WITH_AES_256_CBC_SHA256 TLS / Alert handshake failure
  159. TLS_DHE_DSS_WITH_AES_256_CBC_SHA TLS / Alert handshake failure
  160. TLS_DHE_DSS_WITH_AES_128_GCM_SHA256 TLS / Alert handshake failure
  161. TLS_DHE_DSS_WITH_AES_128_CBC_SHA256 TLS / Alert handshake failure
  162. TLS_DHE_DSS_WITH_AES_128_CBC_SHA TLS / Alert handshake failure
  163. TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA TLS / Alert handshake failure
  164. TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA TLS / Alert handshake failure
  165. TLS_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA TLS / Alert handshake failure
  166. TLS_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA TLS / Alert handshake failure
  167. RSA-PSK-RC4-SHA TLS / Alert handshake failure
  168. RSA-PSK-AES256-CBC-SHA TLS / Alert handshake failure
  169. RSA-PSK-AES128-CBC-SHA TLS / Alert handshake failure
  170. RSA-PSK-3DES-EDE-CBC-SHA TLS / Alert handshake failure
  171. EXP1024-RC4-MD5 TLS / Alert handshake failure
  172. EXP1024-RC2-CBC-MD5 TLS / Alert handshake failure
  173. ECDHE-RSA-CAMELLIA256-SHA384 TLS / Alert handshake failure
  174. ECDHE-RSA-CAMELLIA128-SHA256 TLS / Alert handshake failure
  175. ECDHE-ECDSA-CAMELLIA256-SHA384 TLS / Alert handshake failure
  176. ECDHE-ECDSA-CAMELLIA128-SHA256 TLS / Alert handshake failure
  177. ECDH-RSA-CAMELLIA256-SHA384 TLS / Alert handshake failure
  178. ECDH-RSA-CAMELLIA128-SHA256 TLS / Alert handshake failure
  179. ECDH-ECDSA-CAMELLIA256-SHA384 TLS / Alert handshake failure
  180. ECDH-ECDSA-CAMELLIA128-SHA256 TLS / Alert handshake failure
  181. DHE-RSA-CAMELLIA256-SHA256 TLS / Alert handshake failure
  182. DHE-RSA-CAMELLIA128-SHA256 TLS / Alert handshake failure
  183. DHE-DSS-CAMELLIA256-SHA256 TLS / Alert handshake failure
  184. DHE-DSS-CAMELLIA128-SHA256 TLS / Alert handshake failure
  185. DH-RSA-CAMELLIA256-SHA256 TLS / Alert handshake failure
  186. DH-RSA-CAMELLIA128-SHA256 TLS / Alert handshake failure
  187. DH-DSS-CAMELLIA256-SHA256 TLS / Alert handshake failure
  188. DH-DSS-CAMELLIA128-SHA256 TLS / Alert handshake failure
  189. CAMELLIA256-SHA256 TLS / Alert handshake failure
  190. CAMELLIA128-SHA256 TLS / Alert handshake failure
  191. ADH-CAMELLIA256-SHA256 TLS / Alert handshake failure
  192. ADH-CAMELLIA128-SHA256 TLS / Alert handshake failure
  193. SCAN COMPLETED IN 1.41 S
  194. ------------------------
SSLyze是一个Python库,除了OpenSslCipherSuitesPlugin之外还有很多别的plugin。用户可以通过python调用使用一些更复杂的功能,详情可以参考Github上的官方文档。







声明:本文内容由网友自发贡献,不代表【wpsshop博客】立场,版权归原作者所有,本站不承担相应法律责任。如您发现有侵权的内容,请联系我们。转载请注明出处:https://www.wpsshop.cn/w/凡人多烦事01/article/detail/624260
推荐阅读
相关标签
  

闽ICP备14008679号