Detecting POODLE and BEAST using nmap

Question

Need your expert advice for the following -

1. POODLE - We can deduce if a server is vulnerable to poodle if it supports sslv3 protocol and uses CBC Ciphers.

2. BEAST - Any server supporting sslv3 OR TLS 1.0 and uses CBC Ciphers.

Is my understanding correct? I understand these attacks are exploited on client side but still if a server can be made vulnerable by any means it is vulnerable.

Now, comes the detection part - AFAIK server does not send the complete list of cipher suits to the client but only sends the selected one based on the cipher suits presented to it by the client.

Now, using nmap ssl_enum_ciphers script we can list the cipher suites used by server.

This is what nmap documentation says about ssl_enum_ciphers script:

This script repeatedly initiates SSLv3/TLS connections, 
each time trying a new cipher or compressor while recording 
whether a host accepts or rejects it. 
The end result is a list of all the ciphersuites and compressors that a server accepts.


Some servers use the client's ciphersuite ordering: 
they choose the first of the client's offered suites that they also support. 
Other servers prefer their own ordering: 
they choose their most preferred suite from among those the client offers. 
In the case of server ordering, the script makes extra probes to discover the server's sorted preference list. 
Otherwise, the list is sorted alphabetically.

So, if the server's preferred cipher is RC4 and client provides a CBC cipher (Only one) will it select CBC or rejects the request?

If it chooses CBC then ir-respective of the cipher ordering (nmap's output) then it is vulnerable (?).

If it chooses from client's ciphersuite ordering then definitely it is vulnerable (if it accepts CBC cipher) (?).

Based on above statements, can we infer the following -

1. If server supports sslv3 and we have a CBC cipher anywhere in the cipher list given by nmap, can we say that the server is vulnerable to POODLE?
2. If server supports sslv3/tls 1.0 and we have a CBC cipher anywhere in the cipher list given by nmap, can we say that the server is vulnerable to BEAST?

What i am trying to understand is that based on nmap's output can i infer if it is vulnerable just seeing if it contains CBC cipher or is there any other sophistication involved?

Answer 1

So, if the server's preferred cipher is RC4 and client provides a CBC cipher (Only one) will it select CBC or rejects the request?

If the server supports the CBC cipher that the client provides, the CBC cipher will be used. Otherwise, the connection will fail.

If it chooses CBC then ir-respective of the cipher ordering (nmap's output) then it is vulnerable (?). If it chooses from client's ciphersuite ordering then definitely it is vulnerable (if it accepts CBC cipher) (?).

Every SSLv3 connection to this server using CBC cipher will be vulnerable to POODLE. For BEAST it is a bit more complicated as browsers may implement client-side mitigation.

i) If server supports sslv3 and we have a CBC cipher anywhere in the cipher list given by nmap, can we say that the server is vulnerable to POODLE?

No. To be vulnerable to POODLE, the server must have support for a CBC cipher using SSLv3. If the server only supports RC4 with SSLv3 and CBC ciphers are only supported using TLSv1+, it won't be vulnerable to POODLE.

ii) If server supports sslv3/tls 1.0 and we have a CBC cipher anywhere in the cipher list given by nmap, can we say that the server is vulnerable to BEAST?

Yes, but BEAST attack is not anymore a problem as every modern browser implements client side mitigation of the attack.

What i am trying to understand is that based on nmap's output can i infer if it is vulnerable just seeing if it contains CBC cipher or is there any other sophistication involved?

Finally, yes:

• SSLv3 + CBC = POODLE and BEAST
• TLSv1.0 + CBC = BEAST

Example 1, the following configuration is only vulnerable to BEAST with TLSv1.0 if one of the CBC cipher suite is used:

PORT    STATE SERVICE REASON
443/tcp open  https   syn-ack
| ssl-enum-ciphers:
|   SSLv3:
|     ciphers:
|       TLS_RSA_WITH_RC4_128_MD5 (rsa 2048) - A
|       TLS_RSA_WITH_RC4_128_SHA (rsa 2048) - A
|     compressors:
|       NULL
|     cipher preference: server
|   TLSv1.0:
|     ciphers:
|       TLS_RSA_WITH_RC4_128_MD5 (rsa 2048) - A
|       TLS_RSA_WITH_RC4_128_SHA (rsa 2048) - A
|       TLS_RSA_WITH_3DES_EDE_CBC_SHA (rsa 2048) - C
|       TLS_DHE_RSA_WITH_AES_256_CBC_SHA (dh 256) - A
|       TLS_DHE_RSA_WITH_AES_128_CBC_SHA (dh 256) - A
|     compressors:
|       NULL
|     cipher preference: server
|_  least strength: C

Example 2, the following configuration is only vulnerable to POODLE and BEAST on SSLv3:

PORT    STATE SERVICE REASON
443/tcp open  https   syn-ack
| ssl-enum-ciphers:
|   SSLv3:
|     ciphers:
|       TLS_RSA_WITH_3DES_EDE_CBC_SHA (rsa 2048) - C
|     compressors:
|       NULL
|     cipher preference: server
|   TLSv1.0:
|     ciphers:
|       TLS_RSA_WITH_RC4_128_MD5 (rsa 2048) - A
|       TLS_RSA_WITH_RC4_128_SHA (rsa 2048) - A
|     compressors:
|       NULL
|     cipher preference: server
|_  least strength: C

Example 3 from nmap documentation, the configuration is vulnerable to POODLE on SSLv3 and BEAST on SSLv3 and TLCv1.0 is a CBC cipher suite is used:

PORT    STATE SERVICE REASON
443/tcp open  https   syn-ack
| ssl-enum-ciphers:
|   SSLv3:
|     ciphers:
|       TLS_RSA_WITH_RC4_128_MD5 (rsa 2048) - A
|       TLS_RSA_WITH_RC4_128_SHA (rsa 2048) - A
|       TLS_RSA_WITH_3DES_EDE_CBC_SHA (rsa 2048) - C
|     compressors:
|       NULL
|     cipher preference: server
|   TLSv1.0:
|     ciphers:
|       TLS_RSA_WITH_RC4_128_MD5 (rsa 2048) - A
|       TLS_RSA_WITH_RC4_128_SHA (rsa 2048) - A
|       TLS_RSA_WITH_3DES_EDE_CBC_SHA (rsa 2048) - C
|       TLS_DHE_RSA_WITH_AES_256_CBC_SHA (dh 256) - A
|       TLS_DHE_RSA_WITH_AES_128_CBC_SHA (dh 256) - A
|     compressors:
|       NULL
|     cipher preference: server
|_  least strength: C