Script ssl-cert-intaddr

Script types: portrule
Categories: vuln, discovery, safe
Download: https://svn.nmap.org/nmap/scripts/ssl-cert-intaddr.nse

Script Summary

Reports any private (RFC1918) IPv4 addresses found in the various fields of an SSL service's certificate. These will only be reported if the target address itself is not private. Nmap v7.30 or later is required.

See also:

Script Arguments

tls.servername

See the documentation for the tls library.

smbdomain, smbhash, smbnoguest, smbpassword, smbtype, smbusername

See the documentation for the smbauth library.

smtp.domain

See the documentation for the smtp library.

randomseed, smbbasic, smbport, smbsign

See the documentation for the smb library.

mssql.domain, mssql.instance-all, mssql.instance-name, mssql.instance-port, mssql.password, mssql.protocol, mssql.scanned-ports-only, mssql.timeout, mssql.username

See the documentation for the mssql library.

Example Usage

nmap -p 443 --script ssl-cert-intaddr <target>

Script Output

443/tcp open  https
| ssl-cert-intaddr:
|   Subject commonName:
|     10.5.5.5
|   Subject organizationName:
|     10.0.2.1
|     10.0.2.2
|   Issuer emailAddress:
|     10.6.6.6
|   X509v3 Subject Alternative Name:
|_    10.3.4.5

Requires


Author:

  • Steve Benson

License: Same as Nmap--See https://nmap.org/book/man-legal.html