快速扫描服务端口来获取服务器支持的SSL cipher列表

最新推荐文章于 2024-05-25 15:30:00 发布

eapid

最新推荐文章于 2024-05-25 15:30:00 发布

阅读量9.8k

点赞数 1

文章标签： cipher ssl

本文链接：https://blog.csdn.net/eapid/article/details/80231435

版权

出于安全考虑，网络上的数据传输大部分都是加密传输。我们平时接触到比较多的应该算是https了。HTTPS是在HTTP的基础上通过SSL协议对数据进行加密，以保证用户数据在传输过程中不被窃取。

SSL协议有sslv2, sslv3, tlsv1, tlsv1.1和tlsv1.2。目前推荐使用的只有tlsv1.2，其它协议都存在各种安全漏洞。在每种SSL协议中，又包括了一系列的加密算法，也即是ciphers suite。即使是tlsv1.2的cipher suite，也包含了一些比较弱的加密算法。通常我们需要在服务器端禁止这些cipher。

那我们如何检查我们的服务器是否有安全漏洞，是否支持带安全隐患的SSL协议或者cipher呢？你可以检查服务器的配置，不过如果服务器的数量比较多，这会是一个很繁重的工作，而且不同类型的服务器配置的方法，语法不一，检查起来也不方便。网络上也有一些商业的或者免费的扫描工具可以直接使用。但如果你的服务器只对内网开放，就只能使用内网环境下的工具扫描了。

最简单的方法就是通过openssl s_client命令去检查服务端口，比如

openssl s_client -connect host:port -ssl3
openssl s_client -cipher ECDHE-ECDSA-AES256-GCM-SHA384 -connect host:port

嫌手动麻烦的话可以使用脚本，如下面这个脚本可以用来扫描服务器支持或不支持的cipher(引用自点击打开链接)

#!/usr/bin/env bash

# 运行方式：./scanServerCiphers.sh host:port

# OpenSSL requires the port number.
SERVER=$1
DELAY=1
ciphers=$(openssl ciphers 'ALL:eNULL' | sed -e 's/:/ /g')

echo Obtaining cipher list from $(openssl version).

for cipher in ${ciphers[@]}
do
echo -n Testing $cipher...
result=$(echo -n | openssl s_client -cipher "$cipher" -connect $SERVER 2>&1)
if [[ "$result" =~ ":error:" ]] ; then
  error=$(echo -n $result | cut -d':' -f6)
  echo NO \($error\)
else
  if [[ "$result" =~ "Cipher is ${cipher}" || "$result" =~ "Cipher    :" ]] ; then
    echo YES
  else
    echo UNKNOWN RESPONSE
    echo $result
  fi
fi
sleep $DELAY

不过用这种方式去枚举每一种cipher实在是太耗时了，扫描单台服务器单个端口的速度我都接受不了。

噔噔噔噔，下面另一个工具--sslyze闪亮登场。。。

源码可以在这里下载。最新版本支持pythone 2.7和3.4+，不过有太多依赖包，我选择了比较旧的版本，只支持python 2.7 -->点击打开链接，此版本的requirements.txt貌似写错了，安装之后无法运行，我把它修改成"nassl>=0.13.0,<0.14.0"后可以正常使用。

下面讲一下如何安装和使用。

我是在Linux上使用的，需要安装python-devel

yum install python-devel.x86_64

然后是安装依赖包，此处需要修改一下requirements.txt (上文已有阐述)。不知道pip的请自行百度。

pip install -r requirements.txt

然后就可以直接运行了。

$ python sslyze_cli.py --tlsv1_2 www.baidu.com:443



 AVAILABLE PLUGINS
 -----------------

  FallbackScsvPlugin
  OpenSslCipherSuitesPlugin
  SessionResumptionPlugin
  HstsPlugin
  CertificateInfoPlugin
  CompressionPlugin
  OpenSslCcsInjectionPlugin
  SessionRenegotiationPlugin
  HeartbleedPlugin



 CHECKING HOST(S) AVAILABILITY
 -----------------------------

   www.baidu.com:443                       => 14.215.177.39 



 SCAN RESULTS FOR WWW.BAIDU.COM:443 - 14.215.177.39:443
 ------------------------------------------------------

  * TLSV1_2 Cipher Suites:
      Preferred:                       
        TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256             ECDH-256 bits  128 bits                                                                  
      Accepted:                        
        TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA                ECDH-256 bits  256 bits                                                                  
        TLS_RSA_WITH_AES_256_CBC_SHA                      -              256 bits                                                                  
        TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256             ECDH-256 bits  128 bits                                                                  
        TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA                ECDH-256 bits  128 bits                                                                  
        TLS_RSA_WITH_AES_128_CBC_SHA                      -              128 bits                                                                  
        TLS_ECDHE_RSA_WITH_RC4_128_SHA                    ECDH-256 bits  128 bits                                                                  
        TLS_RSA_WITH_RC4_128_SHA                          -              128 bits                                                                  
      Rejected:                        
        TLS_SRP_SHA_WITH_AES_256_CBC_SHA                  TLS / No ciphers available                                  
        TLS_SRP_SHA_WITH_AES_128_CBC_SHA                  TLS / No ciphers available                                  
        TLS_SRP_SHA_WITH_3DES_EDE_CBC_SHA                 TLS / No ciphers available                                  
        TLS_SRP_SHA_RSA_WITH_AES_256_CBC_SHA              TLS / No ciphers available                                  
        TLS_SRP_SHA_RSA_WITH_AES_128_CBC_SHA              TLS / No ciphers available                                  
        TLS_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA             TLS / No ciphers available                                  
        TLS_SRP_SHA_DSS_WITH_AES_256_CBC_SHA              TLS / No ciphers available                                  
        TLS_SRP_SHA_DSS_WITH_AES_128_CBC_SHA              TLS / No ciphers available                                  
        TLS_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA             TLS / No ciphers available                                  
        TLS_RSA_WITH_SEED_CBC_SHA                         TLS / Alert handshake failure                               
        TLS_RSA_WITH_RC4_128_MD5                          TLS / Alert handshake failure                               
        TLS_RSA_WITH_NULL_SHA256                          TLS / Alert handshake failure                               
        TLS_RSA_WITH_NULL_SHA                             TLS / Alert handshake failure                               
        TLS_RSA_WITH_NULL_MD5                             TLS / Alert handshake failure                               
        TLS_RSA_WITH_IDEA_CBC_SHA                         TLS / Alert handshake failure                               
        TLS_RSA_WITH_DES_CBC_SHA                          TLS / Alert handshake failure                               
        TLS_RSA_WITH_CAMELLIA_256_CBC_SHA                 TLS / Alert handshake failure                               
        TLS_RSA_WITH_CAMELLIA_128_CBC_SHA                 TLS / Alert handshake failure                               
        TLS_RSA_WITH_AES_256_GCM_SHA384                   TLS / Alert handshake failure                               
        TLS_RSA_WITH_AES_256_CBC_SHA256                   TLS / Alert handshake failure                               
        TLS_RSA_WITH_AES_128_GCM_SHA256                   TLS / Alert handshake failure                               
        TLS_RSA_WITH_AES_128_CBC_SHA256                   TLS / Alert handshake failure                               
        TLS_RSA_WITH_3DES_EDE_CBC_SHA                     TLS / Alert handshake failure                               
        TLS_RSA_EXPORT_WITH_RC4_40_MD5                    TLS / Alert handshake failure                               
        TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5                TLS / Alert handshake failure                               
        TLS_RSA_EXPORT_WITH_DES40_CBC_SHA                 TLS / Alert handshake failure                               
        TLS_RSA_EXPORT1024_WITH_RC4_56_SHA                TLS / Alert handshake failure                               
        TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA               TLS / Alert handshake failure                               
        TLS_PSK_WITH_RC4_128_SHA                          TLS / No ciphers available                                  
        TLS_PSK_WITH_AES_256_CBC_SHA                      TLS / No ciphers available                                  
        TLS_PSK_WITH_AES_128_CBC_SHA                      TLS / No ciphers available                                  
        TLS_PSK_WITH_3DES_EDE_CBC_SHA                     TLS / No ciphers available                                  
        TLS_ECDH_anon_WITH_RC4_128_SHA                    TLS / Alert handshake failure                               
        TLS_ECDH_anon_WITH_NULL_SHA                       TLS / Alert handshake failure                               
        TLS_ECDH_anon_WITH_AES_256_CBC_SHA                TLS / Alert handshake failure                               
        TLS_ECDH_anon_WITH_AES_128_CBC_SHA                TLS / Alert handshake failure                               
        TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA               TLS / Alert handshake failure                               
        TLS_ECDH_RSA_WITH_RC4_128_SHA                     TLS / Alert handshake failure                               
        TLS_ECDH_RSA_WITH_NULL_SHA                        TLS / Alert handshake failure                               
        TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384              TLS / Alert handshake failure                               
        TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384              TLS / Alert handshake failure                               
        TLS_ECDH_RSA_WITH_AES_256_CBC_SHA                 TLS / Alert handshake failure                               
        TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256              TLS / Alert handshake failure                               
        TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256              TLS / Alert handshake failure                               
        TLS_ECDH_RSA_WITH_AES_128_CBC_SHA                 TLS / Alert handshake failure                               
        TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA                TLS / Alert handshake failure                               
        TLS_ECDH_ECDSA_WITH_RC4_128_SHA                   TLS / Alert handshake failure                               
        TLS_ECDH_ECDSA_WITH_NULL_SHA                      TLS / Alert handshake failure                               
        TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384            TLS / Alert handshake failure                               
        TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384            TLS / Alert handshake failure                               
        TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA               TLS / Alert handshake failure                               
        TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256            TLS / Alert handshake failure                               
        TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256            TLS / Alert handshake failure                               
        TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA               TLS / Alert handshake failure                               
        TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA              TLS / Alert handshake failure                               
        TLS_ECDHE_RSA_WITH_NULL_SHA                       TLS / Alert handshake failure                               
        TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256       TLS / Alert handshake failure                               
        TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384             TLS / Alert handshake failure                               
        TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384             TLS / Alert handshake failure                               
        TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256             TLS / Alert handshake failure                               
        TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA               TLS / Alert handshake failure                               
        TLS_ECDHE_ECDSA_WITH_RC4_128_SHA                  TLS / Alert handshake failure                               
        TLS_ECDHE_ECDSA_WITH_NULL_SHA                     TLS / Alert handshake failure                               
        TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256     TLS / Alert handshake failure                               
        TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384           TLS / Alert handshake failure                               
        TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384           TLS / Alert handshake failure                               
        TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA              TLS / Alert handshake failure                               
        TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256           TLS / Alert handshake failure                               
        TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256           TLS / Alert handshake failure                               
        TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA              TLS / Alert handshake failure                               
        TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA             TLS / Alert handshake failure                               
        TLS_DH_anon_WITH_SEED_CBC_SHA                     TLS / Alert handshake failure                               
        TLS_DH_anon_WITH_RC4_128_MD5                      TLS / Alert handshake failure                               
        TLS_DH_anon_WITH_DES_CBC_SHA                      TLS / Alert handshake failure                               
        TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA             TLS / Alert handshake failure                               
        TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA             TLS / Alert handshake failure                               
        TLS_DH_anon_WITH_AES_256_GCM_SHA384               TLS / Alert handshake failure                               
        TLS_DH_anon_WITH_AES_256_CBC_SHA256               TLS / Alert handshake failure                               
        TLS_DH_anon_WITH_AES_256_CBC_SHA                  TLS / Alert handshake failure                               
        TLS_DH_anon_WITH_AES_128_GCM_SHA256               TLS / Alert handshake failure                               
        TLS_DH_anon_WITH_AES_128_CBC_SHA256               TLS / Alert handshake failure                               
        TLS_DH_anon_WITH_AES_128_CBC_SHA                  TLS / Alert handshake failure                               
        TLS_DH_anon_WITH_3DES_EDE_CBC_SHA                 TLS / Alert handshake failure                               
        TLS_DH_anon_EXPORT_WITH_RC4_40_MD5                TLS / Alert handshake failure                               
        TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA             TLS / Alert handshake failure                               
        TLS_DH_RSA_WITH_SEED_CBC_SHA                      TLS / Alert handshake failure                               
        TLS_DH_RSA_WITH_DES_CBC_SHA                       TLS / Alert handshake failure                               
        TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA              TLS / Alert handshake failure                               
        TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA              TLS / Alert handshake failure                               
        TLS_DH_RSA_WITH_AES_256_GCM_SHA384                TLS / Alert handshake failure                               
        TLS_DH_RSA_WITH_AES_256_CBC_SHA256                TLS / Alert handshake failure                               
        TLS_DH_RSA_WITH_AES_256_CBC_SHA                   TLS / Alert handshake failure                               
        TLS_DH_RSA_WITH_AES_128_GCM_SHA256                TLS / Alert handshake failure                               
        TLS_DH_RSA_WITH_AES_128_CBC_SHA256                TLS / Alert handshake failure                               
        TLS_DH_RSA_WITH_AES_128_CBC_SHA                   TLS / Alert handshake failure                               
        TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA                  TLS / Alert handshake failure                               
        TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA              TLS / Alert handshake failure                               
        TLS_DH_DSS_WITH_SEED_CBC_SHA                      TLS / Alert handshake failure                               
        TLS_DH_DSS_WITH_DES_CBC_SHA                       TLS / Alert handshake failure                               
        TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA              TLS / Alert handshake failure                               
        TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA              TLS / Alert handshake failure                               
        TLS_DH_DSS_WITH_AES_256_GCM_SHA384                TLS / Alert handshake failure                               
        TLS_DH_DSS_WITH_AES_256_CBC_SHA256                TLS / Alert handshake failure                               
        TLS_DH_DSS_WITH_AES_256_CBC_SHA                   TLS / Alert handshake failure                               
        TLS_DH_DSS_WITH_AES_128_GCM_SHA256                TLS / Alert handshake failure                               
        TLS_DH_DSS_WITH_AES_128_CBC_SHA256                TLS / Alert handshake failure                               
        TLS_DH_DSS_WITH_AES_128_CBC_SHA                   TLS / Alert handshake failure                               
        TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA                  TLS / Alert handshake failure                               
        TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA              TLS / Alert handshake failure                               
        TLS_DHE_RSA_WITH_SEED_CBC_SHA                     TLS / Alert handshake failure                               
        TLS_DHE_RSA_WITH_DES_CBC_SHA                      TLS / Alert handshake failure                               
        TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256         TLS / Alert handshake failure                               
        TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA             TLS / Alert handshake failure                               
        TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA             TLS / Alert handshake failure                               
        TLS_DHE_RSA_WITH_AES_256_GCM_SHA384               TLS / Alert handshake failure                               
        TLS_DHE_RSA_WITH_AES_256_CBC_SHA256               TLS / Alert handshake failure                               
        TLS_DHE_RSA_WITH_AES_256_CBC_SHA                  TLS / Alert handshake failure                               
        TLS_DHE_RSA_WITH_AES_128_GCM_SHA256               TLS / Alert handshake failure                               
        TLS_DHE_RSA_WITH_AES_128_CBC_SHA256               TLS / Alert handshake failure                               
        TLS_DHE_RSA_WITH_AES_128_CBC_SHA                  TLS / Alert handshake failure                               
        TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA                 TLS / Alert handshake failure                               
        TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA             TLS / Alert handshake failure                               
        TLS_DHE_DSS_WITH_SEED_CBC_SHA                     TLS / Alert handshake failure                               
        TLS_DHE_DSS_WITH_RC4_128_SHA                      TLS / Alert handshake failure                               
        TLS_DHE_DSS_WITH_DES_CBC_SHA                      TLS / Alert handshake failure                               
        TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA             TLS / Alert handshake failure                               
        TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA             TLS / Alert handshake failure                               
        TLS_DHE_DSS_WITH_AES_256_GCM_SHA384               TLS / Alert handshake failure                               
        TLS_DHE_DSS_WITH_AES_256_CBC_SHA256               TLS / Alert handshake failure                               
        TLS_DHE_DSS_WITH_AES_256_CBC_SHA                  TLS / Alert handshake failure                               
        TLS_DHE_DSS_WITH_AES_128_GCM_SHA256               TLS / Alert handshake failure                               
        TLS_DHE_DSS_WITH_AES_128_CBC_SHA256               TLS / Alert handshake failure                               
        TLS_DHE_DSS_WITH_AES_128_CBC_SHA                  TLS / Alert handshake failure                               
        TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA                 TLS / Alert handshake failure                               
        TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA             TLS / Alert handshake failure                               
        TLS_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA            TLS / Alert handshake failure                               
        TLS_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA           TLS / Alert handshake failure                               
        RSA-PSK-RC4-SHA                                   TLS / Alert handshake failure                               
        RSA-PSK-AES256-CBC-SHA                            TLS / Alert handshake failure                               
        RSA-PSK-AES128-CBC-SHA                            TLS / Alert handshake failure                               
        RSA-PSK-3DES-EDE-CBC-SHA                          TLS / Alert handshake failure                               
        EXP1024-RC4-MD5                                   TLS / Alert handshake failure                               
        EXP1024-RC2-CBC-MD5                               TLS / Alert handshake failure                               
        ECDHE-RSA-CAMELLIA256-SHA384                      TLS / Alert handshake failure                               
        ECDHE-RSA-CAMELLIA128-SHA256                      TLS / Alert handshake failure                               
        ECDHE-ECDSA-CAMELLIA256-SHA384                    TLS / Alert handshake failure                               
        ECDHE-ECDSA-CAMELLIA128-SHA256                    TLS / Alert handshake failure                               
        ECDH-RSA-CAMELLIA256-SHA384                       TLS / Alert handshake failure                               
        ECDH-RSA-CAMELLIA128-SHA256                       TLS / Alert handshake failure                               
        ECDH-ECDSA-CAMELLIA256-SHA384                     TLS / Alert handshake failure                               
        ECDH-ECDSA-CAMELLIA128-SHA256                     TLS / Alert handshake failure                               
        DHE-RSA-CAMELLIA256-SHA256                        TLS / Alert handshake failure                               
        DHE-RSA-CAMELLIA128-SHA256                        TLS / Alert handshake failure                               
        DHE-DSS-CAMELLIA256-SHA256                        TLS / Alert handshake failure                               
        DHE-DSS-CAMELLIA128-SHA256                        TLS / Alert handshake failure                               
        DH-RSA-CAMELLIA256-SHA256                         TLS / Alert handshake failure                               
        DH-RSA-CAMELLIA128-SHA256                         TLS / Alert handshake failure                               
        DH-DSS-CAMELLIA256-SHA256                         TLS / Alert handshake failure                               
        DH-DSS-CAMELLIA128-SHA256                         TLS / Alert handshake failure                               
        CAMELLIA256-SHA256                                TLS / Alert handshake failure                               
        CAMELLIA128-SHA256                                TLS / Alert handshake failure                               
        ADH-CAMELLIA256-SHA256                            TLS / Alert handshake failure                               
        ADH-CAMELLIA128-SHA256                            TLS / Alert handshake failure                               



 SCAN COMPLETED IN 1.41 S
 ------------------------

SSLyze是一个Python库，除了OpenSslCipherSuitesPlugin之外还有很多别的plugin。用户可以通过python调用使用一些更复杂的功能，详情可以参考Github上的官方文档。

eapid

关注

1
点赞
踩
7

收藏

觉得还不错? 一键收藏
1
评论
快速扫描服务端口来获取服务器支持的SSL cipher列表

出于安全考虑，网络上的数据传输大部分都是加密传输。我们平时接触到比较多的应该算是https了。HTTPS是在HTTP的基础上通过SSL协议对数据进行加密，以保证用户数据在传输过程中不被窃取。SSL协议有sslv2, sslv3, tlsv1, tlsv1.1和tlsv1.2。目前推荐使用的只有tlsv1.2，其它协议都存在各种安全漏洞。在每种SSL协议中，又包括了一系列的加密算法，也即是ciphe...
复制链接

扫一扫