Script `ssl-cert-intaddr`

Script types: portrule
Categories: vuln, discovery, safe
Download: https://svn.nmap.org/nmap/scripts/ssl-cert-intaddr.nse

Script Summary

Reports any private (RFC1918) IPv4 addresses found in the various fields of an SSL service's certificate. These will only be reported if the target address itself is not private. Nmap v7.30 or later is required.

Script Arguments

tls.servername: See the documentation for the tls library.
smbdomain, smbhash, smbnoguest, smbpassword, smbtype, smbusername: See the documentation for the smbauth library.
smtp.domain: See the documentation for the smtp library.
randomseed, smbbasic, smbport, smbsign: See the documentation for the smb library.
mssql.domain, mssql.instance-all, mssql.instance-name, mssql.instance-port, mssql.password, mssql.protocol, mssql.scanned-ports-only, mssql.timeout, mssql.username: See the documentation for the mssql library.

Example Usage

nmap -p 443 --script ssl-cert-intaddr <target>

Script Output

443/tcp open  https
| ssl-cert-intaddr:
|   Subject commonName:
|     10.5.5.5
|   Subject organizationName:
|     10.0.2.1
|     10.0.2.2
|   Issuer emailAddress:
|     10.6.6.6
|   X509v3 Subject Alternative Name:
|_    10.3.4.5

Requires

Author:

Steve Benson

License: Same as Nmap--See https://nmap.org/book/man-legal.html