Friday, October 12, 2007

Nessus -- A peek under the hood - I

-- Check if SSLv2 is supported on remote server

Appears primarily on port 443(https). Need a Linux box with openssl client installed(Type openssl -- if it comes back with options it means it is installed). Now using the openssl binary we can establish a connection using the sslv2 protocol to the destination server on port 443. If it connects and shows you the certificate and that the connection protocol is SSLv2 then it means that SSLv2 is supported on the remote server. Here's the exact command that you'll use:

openssl s_client -connect 192.168.2.249:443 -ssl2

When you get the response back, check right at the bottom for stuff like this:
---------------------------------------------------------
SSL handshake has read 599 bytes and written 239 bytes
---
New, SSLv2, Cipher is DES-CBC3-MD5
Server public key is 1024 bit
---------------------------------------------------------
This shows that an SSLv2 connection was established to the server and the cipher DES-CBC3-MD5 was used to encrypt the connection.

1 comment:

Roshen said...

Thanks for the note, Arvind.

When nessus reports that the web server still supports SSLv2, it's usually correct. The manual check might not be really required. The nasl plugin which checks for SSLv2 support does almost the same operation we manually do with the openssl client.

Roshen