Cipher Suite Discovery Details

The scanner performs active testing to discover all supported cryptographic configurations on remote services.

Overview

Cipher Suite Enumeration

The -cipherscan flag enables comprehensive cipher suite enumeration for TLS connections and key exchange algorithm detection for SSH connections. This feature performs active testing to discover all supported cryptographic configurations on remote services.

TLS Detection

87+ cipher suites across TLS 1.0-1.3, including modern AEAD and legacy CBC modes

SSH Detection

Key exchange, host key algorithms, encryption ciphers, and MAC algorithms

PQC Support

Native detection of ML-DSA, ML-KEM, and hybrid post-quantum algorithms

Important:

Cipher scanning performs multiple connection attempts to enumerate all supported cipher suites. This may trigger security monitoring systems and should only be performed with proper authorization.

Local Quick-Scan Filesystem Behavior

In local mode, -cipherscanquick is enabled by default. When combined with -scanfilesystem, scanning is intentionally targeted to discovered process app roots/working directories (not full default filesystem paths), and application records can include encrypted file detections.

What Gets Detected

TLS Connections

  • Supported cipher suites (TLS 1.0-1.3)
  • Key exchange algorithms (ECDHE, DHE, RSA, PQC)
  • Ephemeral key lengths
  • Negotiated groups (curves)
  • Signature algorithms
  • Protocol versions
  • Session parameters

SSH Connections

  • Key exchange algorithms (KEX)
  • Host key algorithms
  • Encryption ciphers
  • MAC algorithms
  • Compression algorithms
  • SSH protocol version

Usage Examples

Basic Cipher Scanning (BASH):

# Basic cipher enumeration
./certscanner -host example.com -cipherscan

# Scan specific ports
./certscanner -host example.com -ports 443,8443,993 -cipherscan

# Scan multiple hosts with cipher detection
./certscanner -host servers.txt -cipherscan -outputformat json

Performance Management (BASH):

# Conservative resource usage (recommended for production)
./certscanner -host example.com -cipherscan -cputhrottle low

# Balanced performance (default)
./certscanner -host example.com -cipherscan -cputhrottle medium

# Maximum performance
./certscanner -host example.com -cipherscan -cputhrottle high

Tip: Use -cputhrottle low for production environments to minimize resource impact. Cipher scanning can be resource-intensive as it tests multiple cipher suite combinations.