name: performing-ssl-tls-audit description: >- Comprehensive SSL/TLS configuration auditing using testssl.sh, sslyze, and nmap NSE scripts. Covers cipher suite evaluation, protocol version checks, vulnerability scanning (BEAST, POODLE, Heartbleed, ROBOT), HSTS validation, and compliance reporting against Mozilla and NIST guidelines. domain: cybersecurity subdomain: cryptography tags:

• tls
• ssl
• audit
• testssl
• sslyze
• cipher-suites
• hsts
• vulnerability-scanning version: "1.0" author: defconxt license: AGPL-3.0 metadata: mitre-attack: ["T1557.002"]

Performing SSL/TLS Audit

Overview

TLS misconfigurations expose services to downgrade attacks, MITM interception, and data exfiltration. This skill covers systematic auditing of TLS endpoints using industry-standard tools, evaluating against Mozilla's TLS guidelines and NIST SP 800-52 Rev. 2.

Prerequisites

Key Concepts

Full Audit with testssl.sh

# Comprehensive scan
testssl.sh --severity HIGH --wide example.com:443

# Check specific vulnerabilities
testssl.sh --vulnerable example.com:443

# Check cipher suites only
testssl.sh --cipher-per-proto example.com:443

# JSON output for automation
testssl.sh --jsonfile results.json example.com:443

# Check STARTTLS services
testssl.sh --starttls smtp mail.example.com:587

sslyze Scanning

# Regular scan with certificate info
sslyze --regular example.com

# Check for specific vulnerabilities
sslyze --heartbleed --openssl_ccs --robot example.com

# JSON output
sslyze --json_out results.json example.com

# Scan multiple targets
sslyze --targets_in targets.txt --regular

nmap TLS Scripts

# Enumerate TLS ciphers
nmap --script ssl-enum-ciphers -p 443 example.com

# Check for known vulnerabilities
nmap --script ssl-heartbleed,ssl-poodle,ssl-ccs-injection -p 443 example.com

# Certificate information
nmap --script ssl-cert -p 443 example.com

Known TLS Vulnerabilities

Mozilla TLS Profiles

Workflow

1. Scope — Identify all TLS endpoints (ports 443, 8443, 993, 995, etc.)
2. Scan — Run testssl.sh and sslyze against each endpoint
3. Evaluate — Compare against Mozilla Intermediate or Modern profile
4. Classify — Rate findings by severity (Critical/High/Medium/Low)
5. Report — Document with specific remediation per finding
6. Verify — Re-scan after remediation to confirm fixes

Verification

References

• testssl.sh GitHub
• sslyze Documentation
• Mozilla SSL Configuration Generator
• NIST SP 800-52 Rev. 2