[Full-disclosure] Athena SSL Cipher Scanner
athena at dmcdonald.net
Tue Aug 24 13:16:00 BST 2010
I've posted a new SSL Cipher tool onto my website, at
http://dmcdonald.net/athena-ssl-cipher-check_v052.tar.gz, Athena SSL Cipher
Unlike most SSL cipher scanners which have a limited list of ciphers they
know of, athena checks all 65536 cipher codes. Of these codes it can
identify ~150 different ciphers, if it finds a cipher which it cannot
identify, it'll just inform you that it has found a unknown cipher. Rather
than sending it 65536 requests to find these ciphers it sends large blocks
of cipher codes, and uses the server response to narrow down it's search,
similar to a binary search algorithm. It can scan most ssl services in a
couple of minutes or so. Further speed improvements are in the pipeline.
It currently works very well with IIS and apache, but seems to have issues
with Sun HTTP Servers, the reasons behind which ive not yet fully explored.
Note I've reimplimented part of sslv2, sslv3, and tls1, and for all ive know
ive got it wrong and it could completely hose your box, use with caution in
Id be greatful for any feed back/bugs/comments.
-------------- next part --------------
An HTML attachment was scrubbed...
Full-Disclosure is hosted and sponsored by Secunia.