TLS Versions and Ciphers enumeration support

[ehsandeep]

Flag description:

   -ve -version-enum	enumerate and display supported tls versions (false)
   -ce -cipher-enum	enumerate and display supported cipher (false)

CLI Output:

echo tls-v1-0.badssl.com | tlsx -port 1010 -ve 

tls-v1-0.badssl.com:1010 [TLS1.0,TLS1.1,TLS1.2]

JSON Output:

{
   "version-enum":[
      "TLS1.0",
      "TLS1.1",
      "TLS1.2"
   ],
   "cipher-enum": [
      "ECDHE-RSA-AES256-GCM-SHA384",
      "ECDHE-RSA-AES256-SHA384",
      "ECDHE-RSA-AES256-SHA",
      "DHE-RSA-AES256-GCM-SHA384",
      "DHE-RSA-AES256-SHA256",
      "DHE-RSA-AES256-SHA",
      "DHE-RSA-CAMELLIA256-SHA",
      "AES256-GCM-SHA384",
      "AES256-SHA256",
      "AES256-SHA",
      "CAMELLIA256-SHA",
      "ECDHE-RSA-AES128-GCM-SHA256",
      "ECDHE-RSA-AES128-SHA256",
      "ECDHE-RSA-AES128-SHA",
      "DHE-RSA-AES128-GCM-SHA256",
      "DHE-RSA-AES128-SHA256",
      "DHE-RSA-AES128-SHA",
      "DHE-RSA-CAMELLIA128-SHA",
      "AES128-GCM-SHA256",
      "AES128-SHA256",
      "AES128-SHA",
      "CAMELLIA128-SHA",
      "ECDHE-RSA-DES-CBC3-SHA",
      "DES-CBC3-SHA"
    ]
}

[Mzack9999]

Notes:

• TLS1.3 doesn't support ciphers customization and the selection is automatic (ref. crypto/tls: TLS 1.3 ciphers are not configurable golang/go#29349)
• tls-v1-0.badssl.com:1010 supports only tls 1.0

[ehsandeep]

Note: TLS1.3 doesn't support ciphers customization and the selection is automatic (ref. golang/go#29349)

@Mzack9999 I could be wrong, but do you mean to post this on #16?

[Mzack9999]

I think it's relevant also here, as in order to check which cipher are supported by the server we need to perform multiple connections offering only one cipher-suite at a time. In the exposed go tls struct, we know only which one was selected by the server

[dogasantos]

+1 on this.

note: testing with available go libraries require to loop through each hex code that represents the cipher and test via brute-force. However, it may give false negative as I was able to test, so you'll need to add an error handling process that account for that

note2: a to-do test for me, is to research if it is possible to keep the tls channel open and offer each cipher with a single negotiation phase (or less). This would speed up the enumeration and also reduce the number of sockets.