Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
With the recent news about a new OpenSSL vulnerability (affecting 1.0.2 only), I'm looking to conduct some research and I was wondering if there was an way to identify what version of OpenSSL a server is running (without using Nmap). Ideally, I'd like to use OpenSSL itself to identify the server version.
Is there any way that s_client with other params can be used to force a server to throw out the version in use? Maybe key renegotiation?
Thanks.
There is nothing like a "TLS stack type and version" in the TLS specification. OpenSSL by itself has also no kind of non-standard feature which allows you to ask a server for the version. Thus you don't get such explicit information on the protocol level. You might try to guess the version based on behavior changes or specific ciphers which only exist since a specific OpenSSL version, but it is unlikely that you get a very specific result this way.
You might also get a version inside the Server header of the HTTP server, i.e. something like Apache/2.2.24 (Unix) mod_ssl/2.2.24 OpenSSL/1.0.0.e. But this can easily be faked.
On the other hand I doubt that it is useful at all to remotely get the OpenSSL version. At least this can not be used to find out if the server is affected by a specific security issue. Fixes for security issues usually get backported by the distributor and thus it might still be some OpenSSL 1.0.2e but it contains the security fixes (but not the features) from later versions.
Banners can be easily faked. However if a server answers with AES-GCM and TLS1.2 you know you got a pretty new OpenSSL on the other end. I would use nmap's ssl-cipher-enum plugin to determine what protocols and ciphers are available, and map those back to the versions that support them.
