☰

nmap 和 ssl 枚举密码

tag-icon • tag-icon ssl nmap
nmap 和 ssl 枚举密码

我正在尝试使用以下命令检查提供的密码nmap：

$ nmap -Pn --script ssl-enum-ciphers host1.example.org -p 443
Starting Nmap 7.92 ( https://nmap.org ) at 2021-12-13 14:52 CET
Nmap scan report for host1.example.org (129.132.65.51)
Host is up (0.0070s latency).

PORT    STATE SERVICE
443/tcp open  https
| ssl-enum-ciphers: 
|   TLSv1.3: 
|     ciphers: 
|       TLS_AKE_WITH_AES_256_GCM_SHA384 (ecdh_x25519) - A
|       TLS_AKE_WITH_CHACHA20_POLY1305_SHA256 (ecdh_x25519) - A
|       TLS_AKE_WITH_AES_128_GCM_SHA256 (ecdh_x25519) - A
|       TLS_AKE_WITH_AES_128_CCM_SHA256 (ecdh_x25519) - A
|     cipher preference: server
|_  least strength: A

Nmap done: 1 IP address (1 host up) scanned in 1.39 seconds

它工作正常，但对于单一情况：

  • 来自 macOS 的 Fedora 35 (host1.example.org)
$ nmap -Pn --script ssl-enum-ciphers host1.example.org -p 443
Starting Nmap 7.92 ( https://nmap.org ) at 2021-12-13 14:52 CET
Nmap scan report for host1.example.org (129.132.65.51)
Host is up (0.0070s latency).

PORT    STATE SERVICE
443/tcp open  https
| ssl-enum-ciphers: 
|   TLSv1.3: 
|     ciphers: 
|       TLS_AKE_WITH_AES_256_GCM_SHA384 (ecdh_x25519) - A
|       TLS_AKE_WITH_CHACHA20_POLY1305_SHA256 (ecdh_x25519) - A
|       TLS_AKE_WITH_AES_128_GCM_SHA256 (ecdh_x25519) - A
|       TLS_AKE_WITH_AES_128_CCM_SHA256 (ecdh_x25519) - A
|     cipher preference: server
|_  least strength: A

Nmap done: 1 IP address (1 host up) scanned in 1.39 seconds
  • Fedora 35 (host1.example.org) 来自 Fedora 35 (host2.example.org)
$ nmap -Pn --script ssl-enum-ciphers host1.example.org -p 443
Host discovery disabled (-Pn). All addresses will be marked 'up' and scan times will be slower.
Starting Nmap 7.91 ( https://nmap.org ) at 2021-12-13 14:55 CET
Nmap scan report for host1.example.org (129.132.65.51)
Host is up (0.013s latency).

PORT    STATE SERVICE
443/tcp open  https

Nmap done: 1 IP address (1 host up) scanned in 0.35 seconds
  • 其他方向相同的机器。 Fedora 35 (host2.example.org) 来自 Fedora 35 (host1.example.org)
$ nmap -Pn --script ssl-enum-ciphers host2.example.org -p 443
Host discovery disabled (-Pn). All addresses will be marked 'up' and scan times will be slower.
Starting Nmap 7.91 ( https://nmap.org ) at 2021-12-13 14:56 CET
Nmap scan report for host2.example.org (138.201.94.172)
Host is up (0.013s latency).
Other addresses for host2.example.org (not scanned): 2a01:4f8:c17:cbd8::2

PORT    STATE SERVICE
443/tcp open  https
| ssl-enum-ciphers: 
|   TLSv1.2: 
|     ciphers: 
|       TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 (dh 2048) - A
|       TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 (dh 2048) - A
|       TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (secp256r1) - A
|       TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (secp256r1) - A
|       TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (secp256r1) - A
|     compressors: 
|       NULL
|     cipher preference: client
|_  least strength: A

Nmap done: 1 IP address (1 host up) scanned in 0.65 seconds

我真的不明白为什么两台 Fedora 机器都从 macOS 给出结果，但在扫描时却没有给出结果，host1.example.org而host2.example.org两者应该以相同的方式配置。

我该如何调试问题

答案1

host1仅提供 TLS 1.3。我使用了两个不同版本nmap：7.91（不支持 TLS 1.3）和 7.92（支持 TLS 1.3）。

相关内容