Class SSLAnalyzer

modules/webscanner/ssl_analyzer.py:13–207

Analyze SSL/TLS configuration and certificates.

class SSLAnalyzer(WebScannerModule):
    """Analyze SSL/TLS configuration and certificates."""

    name = "ssl"
    description = "Analyze SSL/TLS certificates and configuration"

    WEAK_CIPHERS = [
        "RC4", "DES", "3DES", "MD5", "NULL", "EXPORT", "anon"
    ]

    def __init__(self):
        super().__init__()

    async def run(self, target: Target) -> ScanResult:
        """Analyze SSL/TLS configuration."""
        result = self.create_result(target)

        host = self._extract_host(target.value)
        port = 443
        self.logger.info(f"Analyzing SSL/TLS for {host}:{port}")

        try:
            # Get certificate info
            cert_info = await self._get_certificate(host, port)
            if cert_info:
                result.raw_data["certificate"] = cert_info

                result.add_finding(
                    title="Certificate Information",
                    description=f"Certificate issued to {cert_info.get('subject', 'Unknown')}",
                    severity=Severity.INFO,
                    data=cert_info,
                )

                # Check expiration
                if cert_info.get("not_after"):
                    expiry = datetime.fromisoformat(cert_info["not_after"])
                    days_until_expiry = (expiry - datetime.now()).days

                    if days_until_expiry < 0:
                        result.add_finding(
                            title="Certificate Expired",
                            description=f"Certificate expired {abs(days_until_expiry)} days ago",
                            severity=Severity.CRITICAL,
                        )
                    elif days_until_expiry < 30:
                        result.add_finding(
                            title="Certificate Expiring Soon",
                            description=f"Certificate expires in {days_until_expiry} days",
                            severity=Severity.MEDIUM,
                        )

                # Check for self-signed
                if cert_info.get("issuer") == cert_info.get("subject"):
                    result.add_finding(
                        title="Self-Signed Certificate",
                        description="Certificate appears to be self-signed",
                        severity=Severity.MEDIUM,
                    )