We are, at a certain level, used to assuming that when a connection uses HTTPS with SSL or TLS encryption, it is secured and any attacker that intercepts it will only receive a series of meaningless numbers. Well, this may not be absolutely true; the HTTPS servers need to be correctly configured to provide a strong layer of encryption and to protect users from man-in-the-middle (MITM) attacks or cryptanalysis. A number of vulnerabilities in the implementation and design of the SSL protocol have been discovered and its successor, TLS, has also been found to be vulnerable under certain configurations, thus making the testing of secure connections mandatory in any web application penetration test.
In this recipe, we will use tools such as Nmap, SSLScan, and TestSSL to analyze the configuration (from the client's perspective) of the server...