rex-sslscan 0.1.12 → 0.1.13

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8c7fdc7636e22b47614d8de6f29f9577349ffee063bdbea4b67bbe99bce18af4
-  data.tar.gz: 03bad2316a556f16a8349854585d24d6679a6dfb8028b597219a3809b86044a5
+  metadata.gz: cef4452d76a846d5eba655bd26b54eaf4dc395c460159dbc63513cf2132cc849
+  data.tar.gz: 22297a7682033968b7289572fa14744b18c93a7adc5a83f107739741587dc05b
 SHA512:
-  metadata.gz: fe105a8f01ba50a76ef5a5d3c4308b7fb80c94c34748e28913cb493627ab0cd56df67ba9c9fe48a03dfcf553ff87d7ed6920ea0dfdf2fcc21bae1f867f780dae
-  data.tar.gz: 9c0e262ffe92df3bb2e4ac667e68889ff26969a0b27df40d4bb8077c255297ca722ccfb1fec1d7759dc97860c514c584396d577ff407d29f20bf7797f30cc24a
+  metadata.gz: 02dc4ff4d97bf79b3b7a098c010583933d12ab241c9b84929bec7888c90d75a75dbee9e5038b68fea4dbe8236e99e0d2d825067e76ab71cf4a07564a3c3ea9fc
+  data.tar.gz: b4678f9fe1770c3374c8601d3bc5d7128edb347b86f424655fb9c93b498f635f6b16507929685e5b555dddfb042076604962347c37095ec0a027820f9faabc6b

data/README.md

@@ -23,6 +23,8 @@ Or install it yourself as:
 ## Usage
 
 ```
+require 'rex-sslscan'
+
 scanner = Rex::SSLScan::Scanner.new('192.168.1.1', 443)
 results = scanner.scan
 print_status results.to_s

data/lib/rex/sslscan/scanner.rb

@@ -16,17 +16,20 @@ class Scanner
 
   attr_reader :supported_versions
   attr_reader :sslv2
+  attr_reader :tls_server_name_indication
 
   # Initializes the scanner object
   # @param host [String] IP address or hostname to scan
   # @param port [Integer] Port number to scan, default: 443
   # @param timeout [Integer] Timeout for connections, in seconds. default: 5
+  # @param tls_server_name_indication [String,nil] TLS Server Name Indication (SNI)
   # @raise [StandardError] Raised when the configuration is invalid
-  def initialize(host,port = 443,context = {},timeout=5)
+  def initialize(host,port = 443,context = {},timeout=5,tls_server_name_indication: nil)
     @host       = host
     @port       = port
     @timeout    = timeout
     @context    = context
+    @tls_server_name_indication = tls_server_name_indication
     if check_opensslv2 == true
       @supported_versions = [:SSLv2, :SSLv3, :TLSv1, :TLSv1_1, :TLSv1_2]
       @sslv2 = true
@@ -55,7 +58,7 @@ class Scanner
     scan_result.openssl_sslv2 = sslv2
     # If we can't get any SSL connection, then don't bother testing
     # individual ciphers.
-    if test_ssl == :rejected and test_tls == :rejected
+    if test_ssl == :rejected and test_tls(versions: supported_tls_versions) == :rejected
       return scan_result
     end
 
@@ -106,24 +109,29 @@ class Scanner
     return :accepted
   end
 
-  def test_tls
-    begin
-      scan_client = Rex::Socket::Tcp.create(
-        'Context'    => @context,
-        'PeerHost'   => @host,
-        'PeerPort'   => @port,
-        'SSL'        => true,
-        'SSLVersion' => :TLSv1,
-        'Timeout'    => @timeout
-      )
-    rescue ::Exception => e
-      return :rejected
-    ensure
-      if scan_client
-        scan_client.close
+  def test_tls(versions: [:TLSv1])
+    supported_version = versions.find do |version|
+      begin
+        scan_client = Rex::Socket::Tcp.create(
+          'Context'    => @context,
+          'PeerHost'   => @host,
+          'PeerPort'   => @port,
+          'PeerHostname' => @tls_server_name_indication,
+          'SSL'        => true,
+          'SSLVersion' => version,
+          'Timeout'    => @timeout
+        )
+        version
+      rescue ::Exception => e
+        nil
+      ensure
+        if scan_client
+          scan_client.close
+        end
       end
     end
-    return :accepted
+
+    supported_version ? :accepted : :rejected
   end
 
   # Tests the specified SSL Version and Cipher against the configured target
@@ -137,6 +145,7 @@ class Scanner
         'Context'    => @context,
         'PeerHost'   => @host,
         'PeerPort'   => @port,
+        'PeerHostname' => @tls_server_name_indication,
         'SSL'        => true,
         'SSLVersion' => ssl_version,
         'SSLCipher'  => cipher,
@@ -164,6 +173,7 @@ class Scanner
       scan_client = Rex::Socket::Tcp.create(
         'PeerHost'   => @host,
         'PeerPort'   => @port,
+        'PeerHostname' => @tls_server_name_indication,
         'SSL'        => true,
         'SSLVersion' => ssl_version,
         'SSLCipher'  => cipher,
@@ -187,6 +197,10 @@ class Scanner
 
   protected
 
+  def supported_tls_versions
+    @supported_versions.select { |v| v.to_s.start_with?('TLS') }
+  end
+
   # Validates that the SSL Version and Cipher are valid both seperately and
   # together as part of an SSL Context.
   # @param ssl_version [Symbol] The SSL version to use (:SSLv2,  :SSLv3, :TLSv1)

data/lib/rex/sslscan/version.rb

@@ -1,5 +1,5 @@
 module Rex
   module Sslscan
-    VERSION = "0.1.12"
+    VERSION = "0.1.13"
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rex-sslscan
 version: !ruby/object:Gem::Version
-  version: 0.1.12
+  version: 0.1.13
 platform: ruby
 authors:
 - Metasploit Hackers
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2025-05-02 00:00:00.000000000 Z
+date: 2025-05-10 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake