Checks whether the SSL certificate used by a host has a fingerprint that matches an included database of problematic keys.
The only databases currently checked are the LittleBlackBox 0.1 database of compromised keys from various devices, some keys reportedly used by the Chinese state-sponsored hacking division APT1 (https://www.fireeye.com/blog/threat-research/2013/03/md5-sha1.html), and the key used by CARBANAK malware (https://www.fireeye.com/blog/threat-research/2017/06/behind-the-carbanak-backdoor.html). However, any file of fingerprints will serve just as well. For example, this could be used to find weak Debian OpenSSL keys using the widely available (but too large to include with Nmap) list.
Specify a different file to read fingerprints from.
- mssql.domain, mssql.instance-all, mssql.instance-name, mssql.instance-port, mssql.password, mssql.protocol, mssql.scanned-ports-only, mssql.timeout, mssql.username
See the documentation for the mssql library.
- smbdomain, smbhash, smbnoguest, smbpassword, smbtype, smbusername
See the documentation for the smbauth library.
See the documentation for the smtp library.
- randomseed, smbbasic, smbport, smbsign
See the documentation for the smb library.
See the documentation for the tls library.
nmap --script ssl-known-key -p 443 <host>
PORT STATE SERVICE REASON 443/tcp open https syn-ack |_ssl-known-key: Found in Little Black Box 0.1 (SHA-1: 0028 e7d4 9cfa 4aa5 984f e497 eb73 4856 0787 e496)
License: Same as Nmap--See https://nmap.org/book/man-legal.html