Enumerating TLS Versions with Nmap
Short answer
A The nmap ssl-enum-ciphers script enumerates all supported SSL/TLS versions and ciphers on the target web service.
Question
Key Takeaways
The key distinction is between tools that enumerate supported protocols (like nmap scripts) versus those that restrict connections (like curl flags) or display local info.
Use the Nmap ssl-enum-ciphers script to identify all supported TLS versions on a web service. This question tests knowledge of network enumeration tools for protocol analysis.
Common mistake: Candidates may choose 'curl --tls-max' thinking it checks TLS versions. However, this flag only sets a limit for the client, failing to discover what the server actually supports.
Expert Analysis
The penetration tester's goal is to identify all TLS versions supported by a web service. This is a reconnaissance and enumeration task focused on protocol negotiation capabilities.
Let’s trace the execution path for each option:
- Option A:
nmap --script ssl-enum-ciphers: This Nmap NSE (Nmap Scripting Engine) script specifically targets SSL/TLS services. It connects to the target port, iterates through various SSL/TLS versions (SSLv3, TLS 1.0, 1.1, 1.2, 1.3), and cipher suites. It returns a detailed report listing every version and cipher the server accepts, often assigning a security grade. This directly satisfies the requirement to "identify all TLS versions used". As noted in community feedback, this script provides a comprehensive view of supported protocols, making it the correct tool for this specific enumeration objective. - Option B:
curl --tls-max 3: The--tls-maxflag sets the maximum TLS version curl will use for a connection attempt. It does not enumerate or discover what the server supports; rather, it restricts the client's behavior. Using this command would force curl to try TLS 1.2 or lower, but it wouldn't tell you if the server also supports TLS 1.3. It tests a single constraint, not the full range. - Option C:
wget --server-response: The-Sor--server-responseflag causes wget to print the HTTP response headers from the server. While these headers might contain information about the connection (like the TLS version in some contexts), they do not provide a systematic enumeration of all supported TLS versions. It only shows the result of the single connection made by wget. - Option D:
openssl version: This command displays the version of the OpenSSL software installed on the local machine. It reveals nothing about the remote web service's configuration or supported protocols. It is a local diagnostic tool, not a remote enumeration technique.
Therefore, ssl-enum-ciphers is the only option that actively probes and lists all supported TLS versions on the target.
Official Reference
https://nmap.org/nsedoc/scripts/ssl-enum-ciphers.html
This link opens the official vendor documentation in a new tab.
Exam Strategy
When asked to 'enumerate', 'discover', or 'identify' supported features on a remote service, look for active scanning or probing tools like Nmap scripts. Avoid options that are client-side restrictions (like --tls-max) or local diagnostics (like openssl version), as they do not reveal remote capabilities.
Frequently Asked Questions
What does the ssl-enum-ciphers script return?
Why is curl --tls-max not useful for discovery?
Community Votes
100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 2 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 2
-
leesuh 👍 3 Answered AA. nmap --script ssl-enum-ciphers: ✅ - This Nmap NSE script enumerates supported SSL/TLS versions and ciphers for a given service. - Provides a detailed report, including weak ciphers and outdated protocols. Perfect for assessing TLS security. B. curl --tls-max 3: ❌ - Sets the maximum TLS version when connecting, but does not enumerate all supported versions. Only tests one version at a time. C. wget --server-response: ❌ - Shows HTTP headers, but does not provide information about supported TLS versions. D. openssl version: ❌ - Shows the OpenSSL client/library version, not the server’s TLS versions. Exam Takeaway: - Use nmap --script ssl-enum-ciphers -p 443 <host> to identify TLS versions and cipher suites. Memory Trigger: - Think: “Nmap enumerates TLS.” The script scans the server for all supported TLS versions and ciphers.
-
JHcuttz 👍 1 Answered AThe Nmap script ssl-enum-ciphers connects to a target port and repeatedly attempts to establish a connection using different SSL/TLS versions and cipher suites. It then outputs a comprehensive list of every TLS version the server accepts (e.g., TLS 1.0, 1.1, 1.2, 1.3) along with a letter grade (A through F) indicating how secure they are. This is the perfect tool for identifying weak, outdated versions.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All PT0-003 Questions
Access 120 questions with complete answers and detailed explanations.
View Full PT0-003 Practice Test →