> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/crypto/tools/openssl.md). # Openssl OpenSSL is a software library for applications that provide secure communications over computer networks against eavesdropping, and identify the party at the other end. ## Connect via SSL/TLS Act as a netcat client suppoorting SSL/TLS ```bash openssl s_client -connect localhost:30001 -quiet ``` ## Decrypt files ```bash openssl enc -d -aes-256-cbc -pbkdf2 -iter 100000 -salt -in "/home/ctf-player/drop-in/$file_name" -k picoCTF ``` ## Read and print content of files ### Certificate signing requests ```bash openssl req -in readmycert.csr -noout -text ``` ### DER-encoded x509 RSA certificate ```bash openssl x509 -in 2048b-rsa-example-cert.der -text -noout ``` ### PEM private key ```bash openssl rsa -in privacy_enhanced_mail.pem -text -noout ``` The PEM file begins with the line `-----BEGIN RSA PRIVATE KEY-----`. ## Usage information
openssl -h ```bash ┌──(kali㉿kali)-[~] └─$ openssl -h help: Standard commands asn1parse ca ciphers cmp cms crl crl2pkcs7 dgst dhparam dsa dsaparam ec ecparam enc engine errstr fipsinstall gendsa genpkey genrsa help info kdf list mac nseq ocsp passwd pkcs12 pkcs7 pkcs8 pkey pkeyparam pkeyutl prime rand rehash req rsa rsautl s_client s_server s_time sess_id smime speed spkac srp storeutl ts verify version x509 Message Digest commands (see the `dgst' command for more details) blake2b512 blake2s256 md4 md5 rmd160 sha1 sha224 sha256 sha3-224 sha3-256 sha3-384 sha3-512 sha384 sha512 sha512-224 sha512-256 shake128 shake256 sm3 Cipher commands (see the `enc' command for more details) aes-128-cbc aes-128-ecb aes-192-cbc aes-192-ecb aes-256-cbc aes-256-ecb aria-128-cbc aria-128-cfb aria-128-cfb1 aria-128-cfb8 aria-128-ctr aria-128-ecb aria-128-ofb aria-192-cbc aria-192-cfb aria-192-cfb1 aria-192-cfb8 aria-192-ctr aria-192-ecb aria-192-ofb aria-256-cbc aria-256-cfb aria-256-cfb1 aria-256-cfb8 aria-256-ctr aria-256-ecb aria-256-ofb base64 bf bf-cbc bf-cfb bf-ecb bf-ofb camellia-128-cbc camellia-128-ecb camellia-192-cbc camellia-192-ecb camellia-256-cbc camellia-256-ecb cast cast-cbc cast5-cbc cast5-cfb cast5-ecb cast5-ofb des des-cbc des-cfb des-ecb des-ede des-ede-cbc des-ede-cfb des-ede-ofb des-ede3 des-ede3-cbc des-ede3-cfb des-ede3-ofb des-ofb des3 desx rc2 rc2-40-cbc rc2-64-cbc rc2-cbc rc2-cfb rc2-ecb rc2-ofb rc4 rc4-40 seed seed-cbc seed-cfb seed-ecb seed-ofb sm4-cbc sm4-cfb sm4-ctr sm4-ecb sm4-ofb zlib zstd ```
openssl enc -h ```bash ┌──(kali㉿kali)-[~] └─$ openssl enc -h Usage: enc [options] General options: -help Display this summary -list List ciphers -ciphers Alias for -list -e Encrypt -d Decrypt -p Print the iv/key -P Print the iv/key and exit -engine val Use engine, possibly a hardware device Input options: -in infile Input file -k val Passphrase -kfile infile Read passphrase from file Output options: -out outfile Output file -pass val Passphrase source -v Verbose output -a Base64 encode/decode, depending on encryption flag -base64 Same as option -a -A Used with -[base64|a] to specify base64 buffer as a single line Encryption options: -nopad Disable standard block padding -salt Use salt in the KDF (default) -nosalt Do not use salt in the KDF -debug Print debug info -bufsize val Buffer size -K val Raw key, in hex -S val Salt, in hex -iv val IV in hex -md val Use specified digest to create a key from the passphrase -iter +int Specify the iteration count and force the use of PBKDF2 Default: 10000 -pbkdf2 Use password-based key derivation function 2 (PBKDF2) Use -iter to change the iteration count from 10000 -none Don't encrypt -saltlen +int Specify the PBKDF2 salt length (in bytes) Default: 16 -z Compress or decompress encrypted data using zlib -* Any supported cipher Random state options: -rand val Load the given file(s) into the random number generator -writerand outfile Write random data to the specified file Provider options: -provider-path val Provider load path (must be before 'provider' argument if required) -provider val Provider to load (can be specified multiple times) -propquery val Property query used when fetching algorithms ```
openssl passwd -h ```bash ┌──(kali㉿kali)-[~] └─$ openssl passwd -h Usage: passwd [options] [password] General options: -help Display this summary Input options: -in infile Read passwords from file -noverify Never verify when reading password from terminal -stdin Read passwords from stdin Output options: -quiet No warnings -table Format output as table -reverse Switch table columns Cryptographic options: -salt val Use provided salt -6 SHA512-based password algorithm -5 SHA256-based password algorithm -apr1 MD5-based password algorithm, Apache variant -1 MD5-based password algorithm -aixmd5 AIX MD5-based password algorithm Random state options: -rand val Load the given file(s) into the random number generator -writerand outfile Write random data to the specified file Provider options: -provider-path val Provider load path (must be before 'provider' argument if required) -provider val Provider to load (can be specified multiple times) -propquery val Property query used when fetching algorithms Parameters: password Password text to digest (optional) ```
openssl x509 -h ```bash ┌──(kali㉿kali)-[~] └─$ openssl x509 -h Usage: x509 [options] General options: -help Display this summary -in infile Certificate input, or CSR input file with -req (default stdin) -passin val Private key and cert file pass-phrase source -new Generate a certificate from scratch -x509toreq Output a certification request (rather than a certificate) -req Input is a CSR file (rather than a certificate) -copy_extensions val copy extensions when converting from CSR to x509 or vice versa -inform format CSR input format to use (PEM or DER; by default try PEM first) -vfyopt val CSR verification parameter in n:v form -key val Key for signing, and to include unless using -force_pubkey -signkey val Same as -key -keyform PEM|DER|ENGINE Key input format (ENGINE, other values ignored) -out outfile Output file - default stdout -outform format Output format (DER or PEM) - default PEM -nocert No cert output (except for requested printing) -noout No output (except for requested printing) Certificate printing options: -text Print the certificate in text form -dateopt val Datetime format used for printing. (rfc_822/iso_8601). Default is rfc_822. -certopt val Various certificate text printing options -fingerprint Print the certificate fingerprint -alias Print certificate alias -serial Print serial number value -startdate Print the notBefore field -enddate Print the notAfter field -dates Print both notBefore and notAfter fields -subject Print subject DN -issuer Print issuer DN -nameopt val Certificate subject/issuer name printing options -email Print email address(es) -hash Synonym for -subject_hash (for backward compat) -subject_hash Print subject hash value -subject_hash_old Print old-style (MD5) subject hash value -issuer_hash Print issuer hash value -issuer_hash_old Print old-style (MD5) issuer hash value -ext val Restrict which X.509 extensions to print and/or copy -ocspid Print OCSP hash values for the subject name and public key -ocsp_uri Print OCSP Responder URL(s) -purpose Print out certificate purposes -pubkey Print the public key in PEM format -modulus Print the RSA key modulus Certificate checking options: -checkend intmax Check whether cert expires in the next arg seconds Exit 1 (failure) if so, 0 if not -checkhost val Check certificate matches host -checkemail val Check certificate matches email -checkip val Check certificate matches ipaddr Certificate output options: -set_serial val Serial number to use, overrides -CAserial -next_serial Increment current certificate serial number -days int Number of days until newly generated certificate expires - default 30 -preserve_dates Preserve existing validity dates -set_issuer val Set or override certificate issuer -set_subject val Set or override certificate subject (and issuer) -subj val Alias for -set_subject -force_pubkey infile Key to be placed in new certificate or certificate request -clrext Do not take over any extensions from the source certificate or request -extfile infile Config file with X509V3 extensions to add -extensions val Section of extfile to use - default: unnamed section -sigopt val Signature parameter, in n:v form -badsig Corrupt last byte of certificate signature (for test) -* Any supported digest, used for signing and printing Micro-CA options: -CA infile Use the given CA certificate, conflicts with -key -CAform PEM|DER CA cert format (PEM/DER/P12); has no effect -CAkey val The corresponding CA key; default is -CA arg -CAkeyform PEM|DER|ENGINE CA key format (ENGINE, other values ignored) -CAserial val File that keeps track of CA-generated serial number -CAcreateserial Create CA serial number file if it does not exist Certificate trust output options: -trustout Mark certificate PEM output as trusted -setalias val Set certificate alias (nickname) -clrtrust Clear all trusted purposes -addtrust val Trust certificate for a given purpose -clrreject Clears all the prohibited or rejected uses of the certificate -addreject val Reject certificate for a given purpose Random state options: -rand val Load the given file(s) into the random number generator -writerand outfile Write random data to the specified file -engine val Use engine, possibly a hardware device Provider options: -provider-path val Provider load path (must be before 'provider' argument if required) -provider val Provider to load (can be specified multiple times) -propquery val Property query used when fetching algorithms ```
## Resources openssl - Linux manual page: OpenSSL - Wikipedia: