Identify invalid hostname

[Techbrunch]

I'm not sure if self-signed certificates should also be flagged as mismatched:

❯ echo "target.com" | tlsx -silent -mm
target.com:443 [mismatched]
❯ echo "target.com" | tlsx -silent -cn
target.com:443 [sslvpn]
❯ echo "target.com" | tlsx -silent -ss
target.com:443 [self-signed]

Maybe the logic could be that if the cn is not a valid domain / subdomain it should not be flagged as a mismatch ?

Also the fact that you cannot combine -cn and -mm or -ss is really too bad since it makes it harder to identify problems.

My workaround:

cat subdomains.txt|tlsx -silent -mm -ss|grep -E 'mismatch|signed'|cut -d':' -f1|tlsx -silent -cn

[ehsandeep]

@Techbrunch could you DM me (pd-team) on discord with the host to confirm this behavior?

[Techbrunch]

I updated the issue, this is not a bug.

[Mzack9999]

@ehsandeep we need to detail more the required changes and provide examples

[ehsandeep]

@Techbrunch using CLI flag output for post processing is not good idea when you have all the information included in JSON output without any limits.

here is an example to make use of json output and doing what you shared above without running the scan twice, also the json output will saved to file, so you can reproces the data for any other information.

tlsx -silent -u wrong.host.badssl.com,self-signed.badssl.com,expired.badssl.com -json -o scan | jq -r 'select(.mismatched==true, .self_signed==true) | .host + " [" + .subject_cn +"]"'

wrong.host.badssl.com [*.badssl.com]
self-signed.badssl.com [*.badssl.com]

similarly, you can post process the subject_cn field for invalid hostname detection (depending on what exactly mean by invalid hostname), hopefully we can also have template for specific cases, once tlsx added into nuclei as part of projectdiscovery/nuclei#2368, closing this ticket as mismatch detection is working as intended.