Clarifications regarding testing the cipher using NMAP scan

Question

I'm running the below Nmap command to test the strength of the cipher suites I have used in my host

nmap -sV --script ssl-enum-ciphers -p 8673 <host>

My server supports TLSv1, TLSv1.1, TLSv1.2

I'm using an older NMAP version to test the cipher suite strength using the above command. when I checked the ssl-enum-ciphers.nse file it doesn't have node which is available in [1] for the later versions, also ssl-enum-ciphers.nse file doesn't have any TLSv1.2 related configurations. My file is similar to the file in [2].

But when I'm running this command, I'm getting the below output

8673/tcp open  unknown
| ssl-enum-ciphers: 
|   TLSv1.2: 
|     ciphers: 
|       TLS_DHE_RSA_WITH_AES_128_CBC_SHA (dh 1024) - A
|       TLS_DHE_RSA_WITH_AES_256_CBC_SHA (dh 1024) - A

So I think the testing has been done for the TLSv1.2 as well. So how this actually works?

Appreciate if someone could explain, how this scan is performed for the TLSv1.2 ?

[1] https://svn.nmap.org/nmap/scripts/ssl-enum-ciphers.nse

[2] https://svn.nmap.org/nmap-exp/luis/nping-ng/scripts/ssl-enum-ciphers.nse

Answer 1

<table key="TLSv1.2"> is not configuration. The section you are referring in the NSE script explain the expected XML output.

ssl-enum-ciphers.nse script will enumerate through all tls.PROTOCOLS and then enumerate through all tls.CIPHERS to do the required checks.

tls.lua defines the supported protocols and supported ciphers.

My guess is that the NMap version you are using has tls.lua with TLSv1.2 included, but the ssl-enum-ciphers.nse is not updated with the TLSv1.2 related example outputs. It is anyway best to build latest version of NMap by using the source.