Horrible shell hack to check for enabled SSLv3 on port 443 of a CIDR mask

check_poodle.sh

#!/bin/sh

# Horrible shell hack to check for enabled SSLv3 on port 443 of a CIDR mask.
#
# This is pretty slow because it does them in series. Sticking a '&' on the end
# of the for loop (so "done &" instead of "done") will execute openssl against
# every IP:443 at once. If there's too many to do at once then I suggest
# lashing something up with GNU parallel.
#
# Note also that nmap itself can check for SSLv3 with something like:
#
# for IP in $(nmap --open -sT -p 443 -oG - 192.168.80.0/23 | awk '/Ports/ {print $2}'); do nmap --script ssl-enum-ciphers -sT -p 443 $IP | grep -q SSLv3 && echo "$IP might need fixing"; done
#
# but this seems to be very slow.
#
# Requires:
#
# nmap
# timeout (part of coreutils on Debian/Ubuntu)
# openssl
#
# Example:
#
# $ ./check_poodle.sh 192.168.80.0/23 | grep -v ^#
# !       192.168.80.216 might need fixing
# !       192.168.80.220 might need fixing
# !       192.168.80.221 might need fixing
# !       192.168.80.223 might need fixing
# !       192.168.80.239 might need fixing
# !       192.168.80.244 might need fixing
# !       192.168.80.246 might need fixing
# !       192.168.80.247 might need fixing
# !       192.168.80.252 might need fixing
# !       192.168.80.254 might need fixing

set -e
set -u

# nmap aggression level.
#
# You should only be doing this against your own hosts and nmap docs suggest
# that a decent broadband connection should be able to cope with level 4. If
# you are going through some sort of IDS though, maybe you want to lower
# aggression in order to not trip it. Maximum (most aggressive) is 5, least
# aggressive is 0.
#
# Some example timings, against a /22 (1024 IPs) where roughly half are
# unreachable, across a broadband connection ~8ms away:
#
# 3: 16.88seconds
# 4:  9.53s
# 5:  6.44s
#
# Levels below 3 take several minutes and I can't really be bothered…                                                        
AGGRESSION=4

poodle_check_openssl()
(
    TARGET=$1

    timeout 5 openssl s_client -connect ${TARGET}:443 -ssl3 2>&1 | egrep -q '(SSL alert number 40|SSL3_GET_RECORD:wrong version number)'
)

echo "# Checking for open port 443 in $1..."

for IP in $(nmap -T${AGGRESSION} --open -sT -p 443 -oG - $1 | awk '/Ports/ {print $2}'); do
    echo "# Checking $IP..."
    if poodle_check_openssl ${IP}; then
        echo "#\t$IP looks alright"
    else
        echo "!\t$IP might need fixing"
    fi
done