Let's go through each entry and see what it does:
#
This is the number associated with the result. While at first glance it seems useless (pun intended), you can type use 0 to use the first result, instead of typing use auxiliary/scanner/http/ssl_version. This is a very handy shortcut.
This doesn't just work for use, but every other command that takes a module name as argument (e.g. info).
Name
This is the name of the module, specifically where in the repository the module can be found. Generally, the name describes somewhat what the module will do. In this case, auxiliary/scanner/http/ssl_version shows it's an auxiliary module (meaning it does not directly exploit anything), and that it scans a http server for which SSL and TLS versions it supports. It's pretty self-explanatory, really.
Disclosure Date
This refers to either when the vulnerability was disclosed, or when the module was added. For exploits, it makes sense to check when the vulnerability was disclosed, whereas for other modules (e.g. the above-mentioned scanner), it makes sense to add when the module itself was added.
This may be useful if you want to look for newer exploits, that are generally more likely to work than older exploits.
Rank
The rank determines how well the exploit works. Not every exploit works all the time, so it makes sense to give the user some indication what to expect. Here are the possible values and what they mean (taken from here):
- Excellent: The exploit will never crash the service. This is the case for SQL Injection, CMD execution, RFI, LFI, etc. No typical memory corruption exploits should be given this ranking unless there are extraordinary circumstances.
- Great: The exploit has a default target AND either auto-detects the appropriate target or uses an application-specific return address AFTER a version check.
- Good: The exploit has a default target and it is the "common case" for this type of software (English, Windows 7 for a desktop app, 2012 for server, etc).
- Normal: The exploit is otherwise reliable, but depends on a specific version and can't (or doesn't) reliably autodetect.
- Average: The exploit is generally unreliable or difficult to exploit.
- Low: The exploit is nearly impossible to exploit (or under 50% success rate) for common platforms.
- Manual: The exploit is unstable or difficult to exploit and is basically a DoS. This ranking is also used when the module has no use unless specifically configured by the user.
Why is the scanner labelled "Normal" and not "Excellent"? Only the author knows.
Check
"Check" informs you if the check command is available. Simply put, check checks whether or not the target is (likely to be) vulnerable against the selected exploit. For example, the MS08-067-NetAPI exploit includes a check option, which allows you to verify whether or not exploitation is (likely to be) successful before attempting to exploit the target.
As you can tell, this only really makes sense for some exploits, and may not be possible with every exploit. For the scanner module in your example, it doesn't make sense - the scanner is its own check - so no check is available.
Description
This is a short, one-line description about what the module does. In this case, it informs you that auxiliary/scanner/http/ssl_version is a SSL/TLS version scanner for HTTP servers - which isn't all that surprizing. However, other modules may have slightly more mystifying names, such as exploits/linux/misc/hplip_hpssd_exec, so it's good to get a gist of what a module does. In this case, the description reads "HPLIP hpssd.py From Address Arbitrary Command Execution".
If you still don't know, then the info command will give you a more detailled information, such as:
Description:
This module exploits a command execution vulnerable in the hpssd.py
daemon of the Hewlett-Packard Linux Imaging and Printing Project.
According to MITRE, versions 1.x and 2.x before 2.7.10 are
vulnerable. This module was written and tested using the Fedora 6
Linux distribution. On the test system, the daemon listens on
localhost only and runs with root privileges. Although the
configuration shows the daemon is to listen on port 2207, it
actually listens on a dynamic port. NOTE: If the target system does
not have a 'sendmail' command installed, this vulnerability cannot
be exploited.
That should give you a good indication of what the module does and wheter or not it makes sense for you to run it.
