From ec6a95364befd11497361d4eaa761d46cc4437d6 Mon Sep 17 00:00:00 2001
From: Sascha Kettler <kettler@gmx.net>
Date: Fri, 10 Oct 2014 13:41:51 +0200
Subject: [PATCH 1/4] Added option to sleep between connections

---
 sslscan.c | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/sslscan.c b/sslscan.c
index fc4d98a..4b57a69 100644
--- a/sslscan.c
+++ b/sslscan.c
@@ -142,6 +142,7 @@ struct sslCheckOptions
     int targets;
     int sslbugs;
     int http;
+    int usleep;
     int verbose;
     int ipv4;
     int ipv6;
@@ -801,6 +802,10 @@ int testCompression(struct sslCheckOptions *options, const SSL_METHOD *sslMethod
 
         // Disconnect from host
         close(socketDescriptor);
+
+        if (options->usleep > 0)
+            usleep(options->usleep);
+
     }
     else
     {
@@ -982,6 +987,10 @@ int testRenegotiation(struct sslCheckOptions *options, const SSL_METHOD *sslMeth
 
         // Disconnect from host
         close(socketDescriptor);
+
+        if (options->usleep > 0)
+            usleep(options->usleep);
+
     }
     else
     {
@@ -1077,6 +1086,9 @@ int testHeartbleed(struct sslCheckOptions *options, const SSL_METHOD *sslMethod)
 
         // Disconnect from host
         close(socketDescriptor);
+
+        if (options->usleep > 0)
+            usleep(options->usleep);
     }
     else
     {
@@ -1307,6 +1319,10 @@ int testCipher(struct sslCheckOptions *options, struct sslCipher *sslCipherPoint
 
         // Disconnect from host
         close(socketDescriptor);
+
+        if (options->usleep > 0)
+            usleep(options->usleep);
+
     }
 
     // Could not connect
@@ -1467,6 +1483,9 @@ int defaultCipher(struct sslCheckOptions *options, const SSL_METHOD *sslMethod)
 
         // Disconnect from host
         close(socketDescriptor);
+
+        if (options->usleep > 0)
+            usleep(options->usleep);
     }
 
     // Could not connect
@@ -2538,6 +2557,10 @@ int main(int argc, char *argv[])
         else if (strcmp("--http", argv[argLoop]) == 0)
             options.http = 1;
 
+        // Sleep between connections...
+        else if (strncmp("--usleep=", argv[argLoop], 9) == 0)
+            options.usleep = atoi(argv[argLoop] + 9);
+
         // IPv4 only
         else if (strcmp("--ipv4", argv[argLoop]) == 0)
             options.ipv6 = false;
@@ -2685,6 +2708,7 @@ int main(int argc, char *argv[])
             printf("  %s--starttls-xmpp%s      STARTTLS setup for XMPP\n", COL_GREEN, RESET);
             printf("  %s--http%s               Test a HTTP connection.\n", COL_GREEN, RESET);
             printf("  %s--bugs%s               Enable SSL implementation bug work-arounds\n", COL_GREEN, RESET);
+            printf("  %s--usleep=<time>%s      Set the amount of microseconds to sleep between connections.\n", COL_GREEN, RESET);
             printf("  %s--xml=<file>%s         Output results to an XML file.\n", COL_GREEN, RESET);
             printf("  %s--version%s            Display the program version.\n", COL_GREEN, RESET);
             printf("  %s--verbose%s            Display verbose output.\n", COL_GREEN, RESET);

From 0c885eca13133d22e368e5b2dd3ceef11adb17ea Mon Sep 17 00:00:00 2001
From: Sascha Kettler <kettler@gmx.net>
Date: Fri, 10 Oct 2014 14:21:43 +0200
Subject: [PATCH 2/4] Added option to send RDP handshake before scanning

---
 sslscan.c | 44 +++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 43 insertions(+), 1 deletion(-)

diff --git a/sslscan.c b/sslscan.c
index 4b57a69..5f36220 100644
--- a/sslscan.c
+++ b/sslscan.c
@@ -142,6 +142,7 @@ struct sslCheckOptions
     int targets;
     int sslbugs;
     int http;
+    int rdp;
     int usleep;
     int verbose;
     int ipv4;
@@ -481,6 +482,39 @@ int tcpConnect(struct sslCheckOptions *options)
         printf_verbose("Server reported: %s\n", buffer);
     }
 
+    // Setup an RDP socket with preamble
+    // Borrowed from https://labs.portcullis.co.uk/tools/ssl-cipher-suite-enum/
+    if (options->rdp == true && tlsStarted == false)
+    {
+        unsigned char buffer[32768];
+        size_t readlen;
+
+        tlsStarted = 1;
+
+        // Send RDP preamble
+        send(socketDescriptor, "\x03\x00\x00\x13\x0e\xe0\x00\x00\x00\x00\x00\x01\x00\x08\x00\x03\x00\x00\x00", 19, 0);
+
+        // Read reply header
+        if (4 != recv(socketDescriptor, buffer, 4, 0)) {
+            printf_error("%s    ERROR: unexpected EOF reading from %s:%d%s\n", COL_RED, options->host, options->port, RESET);
+            return 0;
+        }
+
+        // Calculate remaining bytes (and check for overflows)
+        readlen = ((buffer[2] & 0x7f) << 8) + buffer[3] - 4;
+        if (readlen > sizeof(buffer)) {
+            printf_error("%s    ERROR: unexpected data from %s:%d%s\n", COL_RED, options->host, options->port, RESET);
+            return 0;
+
+        }
+
+        // Read reply data
+        if (readlen != recv(socketDescriptor, buffer, readlen, 0)) {
+            printf_error("%s    ERROR: unexpected EOF reading from %s:%d%s\n", COL_RED, options->host, options->port, RESET);
+            return 0;
+        }
+    }
+
     // Return
     return socketDescriptor;
 }
@@ -2235,7 +2269,10 @@ int testHost(struct sslCheckOptions *options)
     printf_xml(" <ssltest host=\"%s\" port=\"%d\">\n", options->host, options->port);
 
     // Test renegotiation
-    printf("Testing SSL server %s%s%s on port %s%d%s\n\n", COL_GREEN, options->host, RESET, COL_GREEN, options->port, RESET);
+    if (options->rdp)
+        printf("Testing RDP server %s%s%s on port %s%d%s\n\n", COL_GREEN, options->host, RESET, COL_GREEN, options->port, RESET);
+    else
+        printf("Testing SSL server %s%s%s on port %s%d%s\n\n", COL_GREEN, options->host, RESET, COL_GREEN, options->port, RESET);
 
     sslCipherPointer = options->ciphers;
 
@@ -2557,6 +2594,10 @@ int main(int argc, char *argv[])
         else if (strcmp("--http", argv[argLoop]) == 0)
             options.http = 1;
 
+        // RDP Preamble...
+        else if (strcmp("--rdp", argv[argLoop]) == 0)
+            options.rdp = 1;
+
         // Sleep between connections...
         else if (strncmp("--usleep=", argv[argLoop], 9) == 0)
             options.usleep = atoi(argv[argLoop] + 9);
@@ -2707,6 +2748,7 @@ int main(int argc, char *argv[])
             printf("  %s--starttls-smtp%s      STARTTLS setup for SMTP\n", COL_GREEN, RESET);
             printf("  %s--starttls-xmpp%s      STARTTLS setup for XMPP\n", COL_GREEN, RESET);
             printf("  %s--http%s               Test a HTTP connection.\n", COL_GREEN, RESET);
+            printf("  %s--rdp%s                Send RDP preamble before starting scan.\n", COL_GREEN, RESET);
             printf("  %s--bugs%s               Enable SSL implementation bug work-arounds\n", COL_GREEN, RESET);
             printf("  %s--usleep=<time>%s      Set the amount of microseconds to sleep between connections.\n", COL_GREEN, RESET);
             printf("  %s--xml=<file>%s         Output results to an XML file.\n", COL_GREEN, RESET);

From bfe581553b21b1a3194ebdba850542503675b7b4 Mon Sep 17 00:00:00 2001
From: Sascha Kettler <kettler@gmx.net>
Date: Wed, 15 Oct 2014 14:19:34 +0200
Subject: [PATCH 3/4] Only flag SSLv3 as yellow (compatibility issues)

---
 sslscan.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sslscan.c b/sslscan.c
index 3ee5917..88092d0 100644
--- a/sslscan.c
+++ b/sslscan.c
@@ -1275,7 +1275,7 @@ int testCipher(struct sslCheckOptions *options, struct sslCipher *sslCipherPoint
                     if (sslCipherPointer->sslMethod == SSLv3_client_method())
                     {
                         printf_xml("SSLv3\" bits=\"");
-                        printf("%sSSLv3%s    ", COL_RED, RESET);
+                        printf("%sSSLv3%s    ", COL_YELLOW, RESET);
                     }
                     else if (sslCipherPointer->sslMethod == TLSv1_client_method())
                     {

From da3f65da1138d38eb4151d7daffe8e8bf6746ff1 Mon Sep 17 00:00:00 2001
From: Sascha Kettler <sascha.kettler@lsexperts.de>
Date: Wed, 16 Dec 2015 10:36:34 +0100
Subject: [PATCH 4/4] Added support for IPv6 in targets file

---
 sslscan.c | 145 +++++++++++++++++++++++++-----------------------------
 sslscan.h |   1 +
 2 files changed, 67 insertions(+), 79 deletions(-)

diff --git a/sslscan.c b/sslscan.c
index 23d6d08..974c252 100644
--- a/sslscan.c
+++ b/sslscan.c
@@ -645,6 +645,68 @@ int freeRenegotiationOutput( struct renegotiationOutput *myRenOut )
     return true;
 }
 
+void parseTarget(char *hostString, struct sslCheckOptions *options) {
+    int tempInt = 0;
+    size_t maxSize = strlen(hostString);
+    options->port = 0;
+
+    if (strncmp(hostString, "https://", 8) == 0)
+    {
+        // Strip https:// from the start of the hostname
+        memmove(hostString, hostString + 8, (maxSize - 8));
+        memset(hostString + (maxSize - 8), 0, 8);
+        maxSize = strlen(hostString);
+    }
+
+    int squareBrackets = false;
+    if (hostString[0] == '[')
+    {
+        squareBrackets = true;
+        // skip the square bracket
+        hostString++;
+    }
+
+    while ((hostString[tempInt] != 0) && ((squareBrackets == true && hostString[tempInt] != ']') || (squareBrackets == false && hostString[tempInt] != ':')))
+        tempInt++;
+
+    if (squareBrackets == true && hostString[tempInt] == ']')
+    {
+        hostString[tempInt] = 0;
+        if (tempInt < maxSize && hostString[tempInt + 1] == ':')
+        {
+            tempInt++;
+            hostString[tempInt] = 0;
+        }
+    }
+    else
+        hostString[tempInt] = 0;
+
+    strncpy(options->host, hostString, sizeof(options->host) - 1);
+
+    // Get port (if it exists)...
+    tempInt++;
+    if (tempInt < maxSize - 1)
+        (*options).port = atoi(hostString + tempInt);
+    else if (options->port == 0) {
+        if (options->starttls_ftp)
+            options->port = 21;
+        if (options->starttls_imap)
+            options->port = 143;
+        if (options->starttls_irc)
+            options->port = 6667;
+        if (options->starttls_pop3)
+            options->port = 110;
+        if (options->starttls_smtp)
+            options->port = 25;
+        if (options->starttls_xmpp)
+            options->port = 5222;
+        if (options->rdp)
+            options->port = 3389;
+        if (options->port == 0)
+            options->port = 443;
+    }
+}
+
 void tls_reneg_init(struct sslCheckOptions *options)
 {
     /* Borrowed from tortls.c to dance with OpenSSL on many platforms, with
@@ -893,10 +955,10 @@ int testRenegotiation(struct sslCheckOptions *options, const SSL_METHOD *sslMeth
                             {
 #endif
                                 // We can't assume that just because the secure renegotiation
-                                // support failed the server doesn't support insecure renegotiations·
+                                // support failed the server doesn't support insecure renegotiations
 
                                 // assume ssl is connected and error free up to here
-                                //setBlocking(ssl); // this is unnecessary if it is already blocking·
+                                //setBlocking(ssl); // this is unnecessary if it is already blocking
                                 printf_verbose("Attempting SSL_renegotiate(ssl)\n");
                                 SSL_renegotiate(ssl); // Ask to renegotiate the connection
                                 // This hangs when an 'encrypted alert' is sent by the server
@@ -3055,8 +3117,6 @@ int main(int argc, char *argv[])
     struct sslCheckOptions options;
     struct sslCipher *sslCipherPointer;
     int argLoop;
-    int tempInt;
-    int maxSize;
     int xmlArg;
     int mode = mode_help;
     int msec;
@@ -3304,66 +3364,9 @@ int main(int argc, char *argv[])
 
             // Get host...
             // IPv6 [] address parsing by DinoTools/phibos
-            tempInt = 0;
-            char *hostString = argv[argLoop];
-
-            maxSize = strlen(hostString);
 
-            if (strncmp((char*)hostString, "https://", 8) == 0)
-            {
-                // Strip https:// from the start of the hostname
-                memmove(hostString, hostString + 8, (maxSize - 8));
-                memset(hostString + (maxSize - 8), 0, 8);
-                maxSize = strlen(hostString);
-            }
-
-            int squareBrackets = false;
-            if (hostString[0] == '[')
-            {
-                squareBrackets = true;
-                // skip the square bracket
-                hostString++;
-            }
-
-            while ((hostString[tempInt] != 0) && ((squareBrackets == true && hostString[tempInt] != ']') || (squareBrackets == false && hostString[tempInt] != ':')))
-                tempInt++;
-
-                if (squareBrackets == true && hostString[tempInt] == ']')
-                {
-                    hostString[tempInt] = 0;
-                    if (tempInt < maxSize && hostString[tempInt + 1] == ':')
-                    {
-                        tempInt++;
-                        hostString[tempInt] = 0;
-                    }
-                }
-                else
-                    hostString[tempInt] = 0;
-
-            strncpy(options.host, hostString, sizeof(options.host) -1);
+            parseTarget(argv[argLoop], &options);
 
-            // Get port (if it exists)...
-            tempInt++;
-            if (tempInt < maxSize - 1)
-                options.port = atoi(hostString + tempInt);
-            else if (options.port == 0) {
-                if (options.starttls_ftp)
-                    options.port = 21;
-                if (options.starttls_imap)
-                    options.port = 143;
-                if (options.starttls_irc)
-                    options.port = 6667;
-                if (options.starttls_pop3)
-                    options.port = 110;
-                if (options.starttls_smtp)
-                    options.port = 25;
-                if (options.starttls_xmpp)
-                    options.port = 5222;
-                if (options.rdp)
-                    options.port = 3389;
-                if (options.port == 0)
-                    options.port = 443;
-            }
         }
 
         // Not too sure what the user is doing...
@@ -3524,23 +3527,7 @@ int main(int argc, char *argv[])
                             if (strlen(line) != 0)
                             {
                                 // Get host...
-                                tempInt = 0;
-                                while ((line[tempInt] != 0) && (line[tempInt] != ':'))
-                                    tempInt++;
-                                line[tempInt] = 0;
-                                strncpy(options.host, line, sizeof(options.host) -1);
-
-                                // Get port (if it exists)...
-                                tempInt++;
-                                if (strlen(line + tempInt) > 0)
-                                {
-                                    options.port = atoi(line + tempInt);
-                                }
-                                // Otherwise assume 443
-                                else
-                                {
-                                    options.port = 443;
-                                }
+                                parseTarget(line, &options);
 
                                 // Test the host...
                                 if (testConnection(&options))
diff --git a/sslscan.h b/sslscan.h
index 1fd9e60..bfded75 100644
--- a/sslscan.h
+++ b/sslscan.h
@@ -194,6 +194,7 @@ void tls_reneg_init(struct sslCheckOptions *);
 int outputRenegotiation(struct sslCheckOptions *, struct renegotiationOutput *);
 struct renegotiationOutput *newRenegotiationOutput(void);
 int freeRenegotiationOutput(struct renegotiationOutput *);
+void parseTarget(char *, struct sslCheckOptions *);
 
 int testCompression(struct sslCheckOptions *, const SSL_METHOD *);
 int testRenegotiation(struct sslCheckOptions *, const SSL_METHOD *);