sslscan
Enumerates ciphers, protocols and certificate of a TLS service.
It interrogates a TLS service and lists which protocol versions it accepts (dead ones included: SSLv2, SSLv3, TLS 1.0), which cipher suites it negotiates and what the certificate holds. In a pentest it feeds the weak-configuration section of the report, but on a CTF box its real value is the certificate: the `CN`, `O` and above all the **SAN** fields reveal internal hostnames and domains you must add to `/etc/hosts` for the right vhost to appear.
Family Web discovery & fuzzing
Flags --show-certificate --no-colour
Concepts From version to exploit
Cheatsheet Discovery & scanning
Installation
sudo apt install sslscanUseful commands
Reference tool: it does not yet appear in a published machine on the blog, but it is part of the arsenal for its everyday use.