rapid7/metasploit-framework — pull request #4034 by todb-r7 (2014-10-16 15:29:12+00:00)
Title: Add a POODLE scanner and general SSL version scan

## Verification steps

- [ ] Scan a host known to have disabled SSLv3
- [ ] Scan a host known to have SSLv3 enabled

## Example

````
msf auxiliary(http_sslv3) > info

Name: HTTP SSL/TLS Version Detection (POODLE scanner)
Module: auxiliary/scanner/http/http_sslv3
License: Metasploit Framework License (BSD)
Rank: Normal

Provided by:
todb

Basic options:
Name Current Setting Required Description
---- --------------- -------- -----------
Proxies no Use a proxy chain
RHOSTS yes The target address range or CIDR identifier
RPORT 443 yes The target port
SSLVersion SSL3 yes Specify the version of SSL that should be used (accepted: SSL2, SSL3, TLS1)
THREADS 1 yes The number of concurrent threads
VHOST no HTTP server virtual host

Description:
Check if an HTTP server supports a given version of SSL/TLS. If a
web server can successfully establish an SSLv3 session, it is likely
to be vulnerable to the POODLE attack described on October 14, 2014,
as a patch against the attack is unlikely.

References:
http://googleonlinesecurity.blogspot.com/2014/10/this-poodle-bites-exploiting-ssl-30.html
http://www.osvdb.org/113251
http://cvedetails.com/cve/2014-3566/

msf auxiliary(http_sslv3) > set rhosts metasploit.com
rhosts => metasploit.com
msf auxiliary(http_sslv3) > exploit

[*] 208.118.237.137:443 does not accept SSLv3
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(http_sslv3) > set rhosts microsoft.com
rhosts => microsoft.com
msf auxiliary(http_sslv3) > run

[+] 134.170.188.221:443 Microsoft-IIS/8.5 ( Powered by ASP.NET, 301-http://www.microsoft.com ) accepts SSLv3
[*] Scanned 1 of 2 hosts (050% complete)
[+] 134.170.185.46:443 Microsoft-IIS/8.5 ( Powered by ASP.NET, 301-http://www.microsoft.com ) accepts SSLv3
[*] Scanned 2 of 2 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(http_sslv3) > hosts

Hosts
=====

address mac name os_name os_flavor os_sp purpose info comments
------- --- ---- ------- --------- ----- ------- ---- --------
134.170.185.46 134.170.185.46 Windows 2012 R2 server
134.170.188.221 134.170.188.221 Windows 2012 R2 server

msf auxiliary(http_sslv3) > vulns
[*] Time: 2014-10-16 15:26:37 UTC Vuln: host=134.170.185.46 name=HTTP SSL/TLS Version Detection (POODLE scanner) refs=URL-http://googleonlinesecurity.blogspot.com/2014/10/this-poodle-bites-exploiting-ssl-30.html,OSVDB-113251,CVE-2014-3566
[*] Time: 2014-10-16 15:26:37 UTC Vuln: host=134.170.188.221 name=HTTP SSL/TLS Version Detection (POODLE scanner) refs=URL-http://googleonlinesecurity.blogspot.com/2014/10/this-poodle-bites-exploiting-ssl-30.html,OSVDB-113251,CVE-2014-3566
msf auxiliary(http_sslv3) >

````