ssl scanner

ssl_scanner.awk

#!/usr/bin/awk -f
#
# Print validty of a cert from a nmap scan report
#
# Alex Negulescu
#
BEGIN {
	nd=0
	start=0
	has_ssl=0
}
{
	if ($0 ~ /Nmap scan report /) {host=$5" "$6}
	if ($0 ~ /^[0-9]+\/tcp\s+open/) { start=NR; port[nd]=substr($0,0,index($0,"/")-1) }
	if ($0 ~ /^\| ssl-cert:/ && NR == start+1) { has_ssl=1 }
	if ($0 ~ /^\| Not valid after:/ && has_ssl == 1) {
	if (match($0,/[0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9][T ][0-9][0-9]:[0-9][0-9]:[0-9][0-9]/)) {
		dates[nd]=substr($0,RSTART,RLENGTH)
		let nd++
		has_ssl=0
		}
	}
}
END {
for (key in dates) {
	print host","port[key]","dates[key] }
}

ssl_scanner.sh

#!/bin/bash
[ -n "$1" ] || { echo "Need dns dump"; exit 1; }

awk '/IN\tA/ && ! /^@/ && ! /^\*/ { if ($NF ~ /[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+/) { if (!map[$NF]++) { if ($1 !~ /__DOMAIN__\.com/) { print $1".__DOMAIN__.com" } else { print $1 } } } }' $1 | while read ipaddr; do
	nmap  --script ssl-cert $ipaddr -p 443,7666,8006,8443,8883 2>&1 | ./ssl_scanner.awk
done