How to check a website for SSLv2 or SSLv3?

user_4458908 0
Viewed 671

I'm trying on a list of websites and trying to get the types of protocols that each website supports. However, I'm only able to retrieve from TLSv1 onwards.

sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
osobj = SSL.Context(SSL.SSLv3_METHOD)
sock.connect((host, int(port)))
oscon = SSL.Connection(osobj, sock)
oscon.set_tlsext_host_name(host.encode())
oscon.set_connect_state()
oscon.do_handshake()

protocol = oscon.get_protocol_version_name() # If website supports SSLv2, it should return 'SSLv2'

I understand that openssl deprecated SSLv2 and SSLv3.

How can I then get the whole list of protocols supported by a website?

pyopenssl openssl ssl python
1 Answers

To check the TLS protocol version that was negotiated in your connection you can call oscon.get_protocol_version_name(). To prevent from using SSLv2/v3 you can use flags OpenSSL.SSL.OP_NO_SSLv2 and OpenSSL.SSL.OP_NO_SSLv2 when setting connection options set_options(). If you need to restrict your connection to use only SSLv2/v3 - set options OpenSSL.SSL.OP_NO_TLSv1, OpenSSL.SSL.OP_NO_TLSv1_1, OpenSSL.SSL.OP_NO_TLSv1_2, OpenSSL.SSL.OP_NO_TLSv1_3. By paying with those options you can fully control TLS version of your connection.

Here's how I would use it in your code fragment:

sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
osobj = SSL.Context(SSL.SSLv23_METHOD)
osobj.set_options(OpenSSL.SSL.OP_NO_TLSv1 | OpenSSL.SSL.OP_NO_TLSv1_1 | OpenSSL.SSL.OP_NO_TLSv1_2 | OpenSSL.SSL.OP_NO_TLSv1_3)
sock.connect(("google.com", int(443)))
oscon = SSL.Connection(osobj, sock)
oscon.set_connect_state()

try:
    oscon.do_handshake()
    print("SSL v2/v3 supported")
except OpenSSL.SSL.Error as err:
    if err.args[0][0][2] == "no protocols available":
        print("SSL v2/v3 is not supported")
user_8365070
Related