1

With the recent news about a new OpenSSL vulnerability (affecting 1.0.2 only), I'm looking to conduct some research and I was wondering if there was an way to identify what version of OpenSSL a server is running (without using Nmap). Ideally, I'd like to use OpenSSL itself to identify the server version.

Is there any way that s_client with other params can be used to force a server to throw out the version in use? Maybe key renegotiation?

Thanks.

Improve this question
1
  • There isn't a built in feature for that for security reasons I assume. What about trying to invoke/test the specific vulnerability in that version?
    – Silverfox
    Feb 2, 2016 at 14:24

2 Answers 2

Reset to default
3

There is nothing like a "TLS stack type and version" in the TLS specification. OpenSSL by itself has also no kind of non-standard feature which allows you to ask a server for the version. Thus you don't get such explicit information on the protocol level. You might try to guess the version based on behavior changes or specific ciphers which only exist since a specific OpenSSL version, but it is unlikely that you get a very specific result this way.

You might also get a version inside the Server header of the HTTP server, i.e. something like Apache/2.2.24 (Unix) mod_ssl/2.2.24 OpenSSL/1.0.0.e. But this can easily be faked.

On the other hand I doubt that it is useful at all to remotely get the OpenSSL version. At least this can not be used to find out if the server is affected by a specific security issue. Fixes for security issues usually get backported by the distributor and thus it might still be some OpenSSL 1.0.2e but it contains the security fixes (but not the features) from later versions.

Improve this answer
3
  • I thought that this would be the case. The issue there is that a lot of servers will have software and versions hidden. I suppose certain Nmap scripts can cover what I need but then again, there is no way to verify that Nmap's findings are correct. Thanks for the information.
    – Sevaara
    Feb 2, 2016 at 14:35
  • @Sevaara: again - it is probably irrelevant which version the server has. It is relevant if the bugs are fixed or not. It is also important if the server supports specific features, but this not only depends on the version of the TLS stack but also on the server settings.
    – Steffen Ullrich
    Feb 2, 2016 at 14:39
  • The best approach is to SSH into the box to get the version built or package used to install the binary.
    – deed02392
    Jan 9, 2019 at 12:06
0

Banners can be easily faked. However if a server answers with AES-GCM and TLS1.2 you know you got a pretty new OpenSSL on the other end. I would use nmap's ssl-cipher-enum plugin to determine what protocols and ciphers are available, and map those back to the versions that support them.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .