Deprecated TLS Detection

ID: deprecated-tls

Severity: info

Author: righettod,forgedhallpass

Tags: ssl,tls

Description

Both TLS 1.1 and SSLv3 are deprecated in favor of stronger encryption.

YAML Source

id: deprecated-tls

info:
  name: Deprecated TLS Detection
  author: righettod,forgedhallpass
  severity: info
  description: |
    Both TLS 1.1 and SSLv3 are deprecated in favor of stronger encryption.
  remediation: |
    Update the web server's TLS configuration to disable TLS 1.1 and SSLv3.
  reference:
    - https://ssl-config.mozilla.org/#config=intermediate
  metadata:
    max-request: 3
    shodan-query: ssl.version:sslv2 ssl.version:sslv3 ssl.version:tlsv1 ssl.version:tlsv1.1
  tags: ssl,tls
ssl:
  - address: "{{Host}}:{{Port}}"
    min_version: tls11
    max_version: tls11

    extractors:
      - type: json
        name: tls_1.1
        json:
          - " .tls_version"

  - address: "{{Host}}:{{Port}}"
    min_version: tls10
    max_version: tls10

    extractors:
      - type: json
        name: tls_1.0
        json:
          - " .tls_version"

  - address: "{{Host}}:{{Port}}"
    min_version: ssl30
    max_version: ssl30

    extractors:
      - type: json
        name: ssl_3.0
        json:
          - " .tls_version"
# digest: 4b0a004830460221008ac28907220514ae762dc6cf3e8c603bc84e33a4d0d2456ecb81174d9f2efb0b0221008848597d25d481c7384c57c6a45877adbe621d9b064b92da72c9430aa63cd1a8:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "ssl/deprecated-tls.yaml"

View on Github