OpenSSL

OpenSSL — Complete OSCP Reference

What is OpenSSL?

OpenSSL is the standard CLI for TLS/SSL, X.509 certificates, hashes, symmetric encryption, and password hash generation. Pre-installed on Kali and most Linux targets.

OSCP use: Grab certs on 443/465/993/995; inspect CN/SAN for vhosts; generate /etc/passwd hashes for privesc; decode encrypted loot; build certs for Socat SSL shells; hash files with dgst.

Install: sudo apt install openssl (Kali: pre-installed)

---

📌 Which Command When

Port 443/993/995/636 open?
    └─ openssl s_client → grab cert, test STARTTLS

Need cert details (CN, SAN, expiry)?
    └─ openssl x509 -noout -text

Linux privesc — add user to /etc/passwd?
    └─ openssl passwd -1 / -6

Found encrypted file + password?
    └─ openssl enc -d

Need file hash (integrity / CTF)?
    └─ openssl dgst -sha256

SSL reverse shell / Socat listener?
    └─ openssl req -x509 -newkey rsa:4096 ...

Password from stdin for script?
    └─ openssl passwd -6 -stdin

See UseCases for ports, Mail (SMTP POP3 IMAP), Socat, Linux.

---

📌 1) s_client — TLS Client (Most Used on OSCP)

Connect to a TLS service and optionally show the certificate chain.

Syntax

openssl s_client [options] [host:port]
openssl s_client -connect HOST:PORT [options]

Connection flags

Flag	Description
-connect HOST:PORT	Target host and port (default port 4433 if omitted)
-host HOST	Hostname for SNI (use with -connect)
-port PORT	Port (alternative to host:port syntax)
-servername NAME	SNI hostname (TLS extension) — important for vhost discovery
-bind ADDR	Local bind address
-proxy HOST:PORT	Connect via HTTP proxy
-proxy_user USER	Proxy auth user
-proxy_pass PASS	Proxy auth password
-unix PATH	Unix domain socket
-4	IPv4 only
-6	IPv6 only

Protocol / cipher flags

Flag	Description
-tls1	Force TLS 1.0
-tls1_1	Force TLS 1.1
-tls1_2	Force TLS 1.2
-tls1_3	Force TLS 1.3
-ssl3	Force SSLv3 (legacy)
-no_ssl3	Disable SSLv3
-cipher VAL	TLS 1.2 and below cipher list
-ciphersuites VAL	TLS 1.3 cipher suites
-min_protocol VAL	Minimum protocol version
-max_protocol VAL	Maximum protocol version
-ign_eof	Ignore EOF on input (stay connected)
-quiet	Minimal output

Certificate / identity flags

Flag	Description
-cert FILE	Client certificate (PEM)
-key FILE	Client private key
-cert_chain FILE	Client cert chain PEM
-CAfile FILE	Trusted CA bundle
-CApath DIR	Directory of hashed CAs
-showcerts	Print all certs in chain
-verify INT	Require peer cert (depth)
-Verify INT	Require peer cert + local cert
-verify_return_error	Exit on verify failure
-verify_hostname HOST	Expected hostname for verify
-brief	Brief connection info

STARTTLS / application protocols

Flag	Description
-starttls protocol	Upgrade cleartext to TLS — smtp, imap, pop3, ftp, xmpp, ldap
-crlf	Convert LF to CRLF (SMTP)
-noservername	Disable SNI
-prexit	Print session info on exit
-reconnect	Drop and reconnect (test session reuse)
-state	Print SSL state machine
-msg	Show protocol messages
-debug	Verbose debug
-help	Full flag list

OSCP examples

# HTTPS — grab certificate
openssl s_client -connect 10.10.10.10:443 </dev/null 2>/dev/null | openssl x509 -noout -text
 
# SNI / vhost — cert for specific hostname
openssl s_client -connect 10.10.10.10:443 -servername dev.target.com </dev/null 2>/dev/null | openssl x509 -noout -subject -ext subjectAltName
 
# Quick cert dates
echo | openssl s_client -connect 10.10.10.10:443 2>/dev/null | openssl x509 -noout -dates -subject -issuer
 
# SMTP STARTTLS (587)
openssl s_client -connect 10.10.10.10:587 -starttls smtp -crlf
 
# SMTPS (465)
openssl s_client -connect 10.10.10.10:465
 
# IMAPS (993)
openssl s_client -connect 10.10.10.10:993
 
# POP3S (995)
openssl s_client -connect 10.10.10.10:995
 
# LDAPS (636)
openssl s_client -connect 10.10.10.10:636
 
# Interactive — type HTTP after connect (rare)
openssl s_client -connect 10.10.10.10:443
# GET / HTTP/1.0

---

📌 2) x509 — Certificate Display & Conversion

Parse, display, and convert X.509 certificates and CSRs.

Syntax

openssl x509 [options] -in FILE

Input / output

Flag	Description
-in FILE	Input cert or CSR
-out FILE	Output file
-inform PEM|DER	Input format
-outform PEM|DER	Output format
-req	Input is a CSR
-text	Human-readable dump
-noout	No PEM output (print-only flags)
-nocert	No cert output

Display fields

Flag	Description
-subject	Subject DN
-issuer	Issuer DN
-dates	notBefore / notAfter
-startdate	notBefore only
-enddate	notAfter only
-serial	Serial number
-fingerprint	Cert fingerprint
-email	Email from subject
-hash	Subject hash (symlink naming)
-subject_hash	Same
-issuer_hash	Issuer hash
-ext EXT	Print extension (e.g. subjectAltName, authorityKeyIdentifier)
-pubkey	Output public key
-modulus	RSA modulus
-nameopt OPT	Name display format

OSCP examples

openssl x509 -in cert.pem -text -noout
openssl x509 -in cert.pem -noout -subject -issuer -dates
openssl x509 -in cert.pem -noout -ext subjectAltName
openssl x509 -in cert.pem -noout -fingerprint -sha256

Pipe from s_client:

openssl s_client -connect TARGET:443 </dev/null 2>/dev/null | openssl x509 -noout -text

---

📌 3) passwd — Password Hash Generation (Privesc)

Ctrl+F: openssl passwd -6 · -1 · /etc/passwd · root user · $6$

Deep dive (add root user, shadow, examples) → openssl passwd

Syntax

openssl passwd [options] [password]
openssl passwd -6 -stdin          # read password from stdin

Flags

Flag	Description
-1	MD5 crypt ($1$...) — common on OSCP Linux privesc
-5	SHA256 crypt ($5$...)
-6	SHA512 crypt ($6$...) — modern default
-apr1	Apache MD5 ($apr1$...)
-aixmd5	AIX MD5
-salt STRING	Specify salt
-stdin	Read password from stdin
-in FILE	Read passwords from file
-quiet	No warnings
-table	Table output format
-help	Help

OSCP examples

# SHA-512 — modern default ($6$)
openssl passwd -6 "NewPassword123!"
# $6$rounds=5000$...
 
# MD5 crypt — insert into /etc/passwd (older boxes)
openssl passwd -1 password123
openssl passwd -1 -salt test1 test1
# $1$xyz$...
 
# Add root-equivalent user (if /etc/passwd writable)
HASH=$(openssl passwd -6 "NewPassword123!")
echo "newroot:${HASH}:0:0:root:/root:/bin/bash" | sudo tee -a /etc/passwd
su newroot
 
# MD5 one-liner
echo 'newroot:$(openssl passwd -1 password):0:0:root:/root:/bin/bash' | sudo tee -a /passwd
 
# SHA512 via stdin
echo -n 'password123' | openssl passwd -6 -stdin

→ Full privesc workflows: openssl passwd · Linux

---

📌 4) dgst — Hash / Message Digest

openssl dgst [options] [file...]

Common flags

Flag	Description
-help	Help
-list	List supported digests
-sha1	SHA-1
-sha256	SHA-256
-sha512	SHA-512
-md5	MD5
-hmac KEY	HMAC with key
-mac ALG	MAC algorithm
-hex	Hex output (default for binary)
-binary	Binary output
-out FILE	Write to file
-sign FILE	Sign digest with private key
-verify FILE	Verify signature
-signature FILE	Signature file
-engine ID	Hardware engine

Examples

openssl dgst -sha256 file.bin
openssl dgst -md5 secret.txt
openssl dgst -sha256 -hmac "secretkey" message.txt

---

📌 5) enc — Symmetric Encrypt / Decrypt

openssl enc [options]

General

Flag	Description
-e	Encrypt (default)
-d	Decrypt
-list	List ciphers
-help	Help

I/O

Flag	Description
-in FILE	Input
-out FILE	Output
-pass pass:PASSWORD	Password on command line
-pass file:FILE	Password from file
-pass stdin	Password from stdin
-k PASSWORD	Password shorthand
-kfile FILE	Password file
-a / -base64	Base64 encode/decode
-A	Single-line base64
-v	Verbose
-p	Print key and IV
-P	Print key/IV and exit

Crypto options

Flag	Description
-salt	Use salt in KDF (default)
-nosalt	No salt
-md ALG	Digest for KDF (e.g. sha256)
-pbkdf2	PBKDF2 key derivation
-iter N	PBKDF2 iterations
-K HEX	Raw key (hex)
-iv HEX	IV (hex)
-S HEX	Salt (hex)
-nopad	Disable padding
-bufsize N	Buffer size

Cipher (positional or -cipher)

Common: aes-256-cbc, aes-128-cbc, des3, bf, rc4, base64 (via enc)

Examples

# Encrypt
openssl enc -aes-256-cbc -salt -in plain.txt -out plain.enc -pass pass:secret
 
# Decrypt
openssl enc -aes-256-cbc -d -in plain.enc -out plain.txt -pass pass:secret
 
# Base64 encode/decode
openssl enc -base64 -in file.bin -out file.b64
openssl enc -base64 -d -in file.b64 -out file.bin

---

📌 6) req — Certificate Signing Request / Self-Signed Cert

Create CSRs or self-signed certificates (SSL shells, testing).

openssl req [options]

Flag	Description
-new	New CSR
-newkey rsa:4096	Generate new RSA key + CSR
-key FILE	Existing key
-keyout FILE	Output key file
-out FILE	Output CSR/cert
-x509	Output self-signed cert instead of CSR
-days N	Validity days
-subj "/CN=localhost/O=Org/C=US"	Subject (non-interactive)
-nodes	No encryption on private key
-passin SRC	Key password source
-passout SRC	Output key password
-config FILE	OpenSSL config
-extensions NAME	Config extension section
-addext KEY=VALUE	Add extension inline
-text	Text output
-noout	No PEM output
-verify	Verify CSR self-signature
-help	Help

OSCP — Socat / SSL shell cert (one-liner)

openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 -nodes \
  -subj "/CN=localhost"

See Socat, Shells.

---

📌 7) genrsa / rsa / pkey — Key Generation

genrsa

openssl genrsa [options] NUMBITS

Flag	Description
-out FILE	Output key file
-passout SRC	Encrypt output key
-F4 / -f4	Use Fermat F4 as public exponent
-traditional	Traditional PEM format
-help	Help

openssl genrsa -out private.key 4096

rsa

openssl rsa -in private.key -pubout -out public.key
openssl rsa -in private.key -text -noout

pkey (generic)

openssl pkey -in key.pem -text -noout
openssl pkey -in key.pem -pubout -out pub.pem

---

📌 8) s_server — Test TLS Server

Rare on OSCP; useful for local SSL testing.

openssl s_server [options]

Flag	Description
-accept PORT	Listen port (default 4433)
-cert FILE	Server certificate
-key FILE	Private key
-www	Send HTTP response after connect
-HTTP	Simple HTTP server
-quiet	Quiet
-help	Help

openssl s_server -accept 4443 -cert cert.pem -key key.pem -www

---

📌 9) Other Useful Subcommands

Command	Purpose	Quick example
openssl version	Version	openssl version -a
openssl list	List algorithms	openssl list -digest-algorithms
openssl rand	Random bytes	openssl rand -hex 32
openssl pkcs12	PKCS#12 import/export	openssl pkcs12 -in cert.pfx -nodes -out out.pem
openssl verify	Verify cert chain	openssl verify -CAfile ca.pem cert.pem
openssl cms	CMS encrypt/sign	CTF / email forensics
openssl smime	S/MIME	Mail forensics
openssl rsautl	RSA encrypt/decrypt	Legacy CTF
openssl pkeyutl	Public key ops	Encrypt small blobs
openssl speed	Benchmark	—

rand flags

Flag	Description
-hex	Hex output
-base64	Base64 output
-out FILE	Write to file

openssl rand -hex 16
openssl rand -base64 32

pkcs12 common flags

Flag	Description
-in FILE	Input .pfx/.p12
-out FILE	Output PEM
-nodes	Don’t encrypt private keys in output
-passin pass:PASS	Import password
-info	Print structure info
-nokeys	Certs only
-nocerts	Keys only

---

📌 10) Standard Commands List

openssl help                    # All standard commands
openssl list -help              # List subcommands for digests/ciphers

Common OSCP commands: s_client, x509, passwd, enc, dgst, req, genrsa, rsa, pkey, rand, pkcs12, verify

---

📌 Quick OSCP Cheat Sheet

# TLS cert grab + inspect
openssl s_client -connect TARGET:443 </dev/null 2>/dev/null | openssl x509 -noout -text
openssl s_client -connect TARGET:443 -servername vhost.target.com </dev/null 2>/dev/null | openssl x509 -noout -ext subjectAltName
 
# Mail TLS
openssl s_client -connect TARGET:587 -starttls smtp -crlf
openssl s_client -connect TARGET:993
openssl s_client -connect TARGET:995
 
# Privesc passwd hash
openssl passwd -6 'NewPassword123!'
openssl passwd -1 'password123'
 
# Self-signed cert
openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 -nodes -subj "/CN=localhost"
 
# Hash / decrypt
openssl dgst -sha256 file
openssl enc -aes-256-cbc -d -in file.enc -out file -pass pass:secret

---

Related Tools

• Curl
• Socat
• xxd
• Base64
• Nmap

Related Notes

• Linux Tools
• Linux
• openssl passwd
• UseCases for ports
• Mail (SMTP POP3 IMAP)
• Socat
• Shells
• Networking
• Training