From 116613380693cdb9257c349e9de6c39280e72c7c Mon Sep 17 00:00:00 2001 From: nnposter Date: Sun, 15 Dec 2024 23:49:31 +0000 Subject: [PATCH] Add SHA-256 fingerprint, refresh documentation. Closes #2978 --- scripts/ssl-cert.nse | 178 ++++++++++++++++++++++++++++--------------- 1 file changed, 117 insertions(+), 61 deletions(-) diff --git a/scripts/ssl-cert.nse b/scripts/ssl-cert.nse index 0e4ab77b3..03f5ff2d5 100644 --- a/scripts/ssl-cert.nse +++ b/scripts/ssl-cert.nse @@ -11,34 +11,44 @@ local unicode = require "unicode" local have_openssl, openssl = pcall(require, "openssl") description = [[ -Retrieves a server's SSL certificate. The amount of information printed -about the certificate depends on the verbosity level. With no extra -verbosity, the script prints the validity period and the commonName, -organizationName, stateOrProvinceName, and countryName of the subject. +Retrieves a server's SSL certificate. The amount of information printed about +the certificate depends on the verbosity level. With no extra verbosity, the +script prints the validity period and the commonName, organizationName, +stateOrProvinceName, and countryName of the subject. When present, it also +outputs all the subject alternative names. 443/tcp open https -| ssl-cert: Subject: commonName=www.paypal.com/organizationName=PayPal, Inc.\ +| ssl-cert: Subject: commonName=www.paypal.com/organizationName=PayPal, Inc. /stateOrProvinceName=California/countryName=US -| Not valid before: 2011-03-23 00:00:00 -|_Not valid after: 2013-04-01 23:59:59 +| Subject Alternative Name: DNS:www.paypal.com, DNS:fastlane.paypal.com, +DNS:secure.paypal.com, DNS:www-st.paypal.com, DNS:connect.paypal.com, +... +DNS:es.paypal-qrc.com, DNS:www.fastlane.paypal.com +| Not valid before: 2024-02-08T00:00:00 +|_Not valid after: 2025-02-08T23:59:59 With -v it adds the issuer name and fingerprints. 443/tcp open https -| ssl-cert: Subject: commonName=www.paypal.com/organizationName=PayPal, Inc.\ +| ssl-cert: Subject: commonName=www.paypal.com/organizationName=PayPal, Inc. /stateOrProvinceName=California/countryName=US -| Issuer: commonName=VeriSign Class 3 Extended Validation SSL CA\ -/organizationName=VeriSign, Inc./countryName=US +| Subject Alternative Name: DNS:www.paypal.com, DNS:fastlane.paypal.com, +DNS:secure.paypal.com, DNS:www-st.paypal.com, DNS:connect.paypal.com, +... +DNS:es.paypal-qrc.com, DNS:www.fastlane.paypal.com +| Issuer: commonName=DigiCert SHA2 Extended Validation Server CA +/organizationName=DigiCert Inc/countryName=US/organizationalUnitName=www.digicert.com | Public Key type: rsa | Public Key bits: 2048 -| Signature Algorithm: sha1WithRSAEncryption -| Not valid before: 2011-03-23 00:00:00 -| Not valid after: 2013-04-01 23:59:59 -| MD5: bf47 ceca d861 efa7 7d14 88ad 4a73 cb5b -|_SHA-1: d846 5221 467a 0d15 3df0 9f2e af6d 4390 0213 9a68 +| Signature Algorithm: sha256WithRSAEncryption +| Not valid before: 2024-02-08T00:00:00 +| Not valid after: 2025-02-08T23:59:59 +| MD5: 7cc7 a345 a164 dfb1 4690 0277 a540 f636 +| SHA-1: 9269 a100 8f61 aa60 1706 fc85 fd47 d277 66c0 f591 +|_SHA-256: d76b 791c e89c 043a c25d 19f3 97b2 91d5 5d94 b1c2 72df 8d1f 4bab fdc1 91a7 413b With -vv it adds the PEM-encoded contents of the entire @@ -46,25 +56,26 @@ certificate. 443/tcp open https -| ssl-cert: Subject: commonName=www.paypal.com/organizationName=PayPal, Inc.\ -/stateOrProvinceName=California/countryName=US/1.3.6.1.4.1.311.60.2.1.2=Delaware\ -/postalCode=95131-2021/localityName=San Jose/serialNumber=3014267\ -/streetAddress=2211 N 1st St/1.3.6.1.4.1.311.60.2.1.3=US\ -/organizationalUnitName=PayPal Production/businessCategory=Private Organization -| Issuer: commonName=VeriSign Class 3 Extended Validation SSL CA\ -/organizationName=VeriSign, Inc./countryName=US\ -/organizationalUnitName=Terms of use at https://www.verisign.com/rpa (c)06 +| ssl-cert: Subject: commonName=www.paypal.com/organizationName=PayPal, Inc. +/stateOrProvinceName=California/countryName=US +| Subject Alternative Name: DNS:www.paypal.com, DNS:fastlane.paypal.com, +DNS:secure.paypal.com, DNS:www-st.paypal.com, DNS:connect.paypal.com, +... +DNS:es.paypal-qrc.com, DNS:www.fastlane.paypal.com +| Issuer: commonName=DigiCert SHA2 Extended Validation Server CA +/organizationName=DigiCert Inc/countryName=US/organizationalUnitName=www.digicert.com | Public Key type: rsa | Public Key bits: 2048 -| Signature Algorithm: sha1WithRSAEncryption -| Not valid before: 2011-03-23 00:00:00 -| Not valid after: 2013-04-01 23:59:59 -| MD5: bf47 ceca d861 efa7 7d14 88ad 4a73 cb5b -| SHA-1: d846 5221 467a 0d15 3df0 9f2e af6d 4390 0213 9a68 +| Signature Algorithm: sha256WithRSAEncryption +| Not valid before: 2024-02-08T00:00:00 +| Not valid after: 2025-02-08T23:59:59 +| MD5: 7cc7 a345 a164 dfb1 4690 0277 a540 f636 +| SHA-1: 9269 a100 8f61 aa60 1706 fc85 fd47 d277 66c0 f591 +|_SHA-256: d76b 791c e89c 043a c25d 19f3 97b2 91d5 5d94 b1c2 72df 8d1f 4bab fdc1 91a7 413b | -----BEGIN CERTIFICATE----- -| MIIGSzCCBTOgAwIBAgIQLjOHT2/i1B7T//819qTJGDANBgkqhkiG9w0BAQUFADCB +| MIINmjCCDIKgAwIBAgIQDSuPFewZcdj2USYg2ZUIJzANBgkqhkiG9w0BAQsFADB1 ... -| 9YDR12XLZeQjO1uiunCsJkDIf9/5Mqpu57pw8v1QNA== +| 6BlCzB65H3ngMIyKoeBQJyV9skuM/mHY/hUsQVIE |_-----END CERTIFICATE----- ]] @@ -74,51 +85,94 @@ certificate. -- -- @output -- 443/tcp open https --- | ssl-cert: Subject: commonName=www.paypal.com/organizationName=PayPal, Inc.\ +-- | ssl-cert: Subject: commonName=www.paypal.com/organizationName=PayPal, Inc. -- /stateOrProvinceName=California/countryName=US --- | Not valid before: 2011-03-23 00:00:00 --- |_Not valid after: 2013-04-01 23:59:59 +-- | Subject Alternative Name: DNS:www.paypal.com, DNS:fastlane.paypal.com, +-- DNS:secure.paypal.com, DNS:www-st.paypal.com, DNS:connect.paypal.com, +-- ... +-- DNS:es.paypal-qrc.com, DNS:www.fastlane.paypal.com +-- | Not valid before: 2024-02-08T00:00:00 +-- |_Not valid after: 2025-02-08T23:59:59 -- -- @xmloutput -- --- Delaware --- US --- 95131-2021 --- San Jose --- 3014267 --- US --- California --- 2211 N 1st St --- PayPal Production --- www.paypal.com --- PayPal, Inc. -- Private Organization +-- www.paypal.com +-- US +-- US +-- Delaware +-- San Jose +-- PayPal, Inc. +-- 3014267 +-- California --
-- --- Terms of use at https://www.verisign.com/rpa (c)06 --- VeriSign, Inc. --- VeriSign Class 3 Extended Validation SSL CA +-- DigiCert SHA2 Extended Validation Server CA -- US +-- DigiCert Inc +-- www.digicert.com --
-- -- rsa -- 2048 --- DF40CCF2C50A0D65....35B5927DF25D4DE5 +-- DC8F8DADDF5E33F8...5A873998377D7DAF -- 65537 --
--- sha1WithRSAEncryption --- --- 2011-03-23T00:00:00+00:00 --- 2013-04-01T23:59:59+00:00 +--
+--
+-- X509v3 Authority Key Identifier +-- 3D:D3:50:A5:D6:A0:AD:EE:F3:4A:60:0A:65:D3:21:D4:F8:F8:D6:0F +--
+-- +-- X509v3 Subject Key Identifier +-- 35:04:FA:12:18:AA:18:01:EC:C7:87:49:7A:02:77:98:7C:DF:BC:5F +--
+-- +-- X509v3 Subject Alternative Name +-- DNS:www.paypal.com, ..., DNS:www.fastlane.paypal.com +--
+-- +-- X509v3 Certificate Policies +-- Policy: 2.16.840.1.114412.2.1 Policy: 2.23.140.1.1 CPS: http://www.digicert.com/CPS +--
+-- +-- X509v3 Key Usage +-- Digital Signature, Key Encipherment +-- true +--
+-- +-- X509v3 Extended Key Usage +-- TLS Web Server Authentication, TLS Web Client Authentication +--
+-- +-- X509v3 CRL Distribution Points +-- Full Name: URI:http://crl3.digicert.com/sha2-ev-server-g3.crl Full Name: URI:http://crl4.digicert.com/sha2-ev-server-g3.crl +--
+-- +-- Authority Information Access +-- OCSP - URI:http://ocsp.digicert.com CA Issuers - URI:http://cacerts.digicert.com/DigiCertSHA2ExtendedValidationServerCA.crt +--
+-- +-- X509v3 Basic Constraints +-- CA:FALSE +-- true +--
+-- +-- CT Precertificate SCTs +-- Signed Certificate Timestamp:... D:1C:0C:93:8C:6A:33:93 +--
-- --- bf47cecad861efa77d1488ad4a73cb5b --- d8465221467a0d153df09f2eaf6d439002139a68 --- -----BEGIN CERTIFICATE----- --- MIIGSzCCBTOgAwIBAgIQLjOHT2/i1B7T//819qTJGDANBgkqhkiG9w0BAQUFADCB +-- sha256WithRSAEncryption +-- +-- 2024-02-08T00:00:00 +-- 2025-02-08T23:59:59 +--
+-- 7cc7a345a164dfb146900277a540f636 +-- 9269a1008f61aa601706fc85fd47d27766c0f591 +-- d76b791ce89c043ac25d19f397b291d55d94b1c272df8d1f4babfdc191a7413b +-- -----BEGIN CERTIFICATE----- MIINmjCC -- ... --- 9YDR12XLZeQjO1uiunCsJkDIf9/5Mqpu57pw8v1QNA== --- -----END CERTIFICATE----- --- +-- /hUsQVIE -----END CERTIFICATE----- author = "David Fifield" @@ -258,6 +312,7 @@ local function output_tab(cert) end o.md5 = stdnse.tohex(cert:digest("md5")) o.sha1 = stdnse.tohex(cert:digest("sha1")) + o.sha256 = stdnse.tohex(cert:digest("sha256")) o.pem = cert.pem return o end @@ -295,8 +350,9 @@ local function output_str(cert) date_to_string(cert.validity.notAfter) if nmap.verbosity() > 0 then - lines[#lines + 1] = "MD5: " .. stdnse.tohex(cert:digest("md5"), { separator = " ", group = 4 }) - lines[#lines + 1] = "SHA-1: " .. stdnse.tohex(cert:digest("sha1"), { separator = " ", group = 4 }) + lines[#lines + 1] = "MD5: " .. stdnse.tohex(cert:digest("md5"), { separator = " ", group = 4 }) + lines[#lines + 1] = "SHA-1: " .. stdnse.tohex(cert:digest("sha1"), { separator = " ", group = 4 }) + lines[#lines + 1] = "SHA-256: " .. stdnse.tohex(cert:digest("sha256"), { separator = " ", group = 4 }) end if nmap.verbosity() > 1 then