<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Performing SSL/TLS Audit

## testssl.sh

### Synopsis

```bash
testssl.sh [options] <target:port>
```

### Key Options

| Option | Description |
|---|---|
| `--severity <level>` | Filter output by severity (LOW, MEDIUM, HIGH, CRITICAL) |
| `--wide` | Wide output with full cipher details |
| `--vulnerable` | Test for known TLS vulnerabilities |
| `--cipher-per-proto` | List ciphers per protocol version |
| `--protocols` | Check supported protocol versions |
| `--heartbleed` | Test for Heartbleed (CVE-2014-0160) |
| `--poodle` | Test for POODLE (CVE-2014-3566) |
| `--robot` | Test for ROBOT (CVE-2017-13099) |
| `--jsonfile <path>` | Write JSON results to file |
| `--starttls <proto>` | STARTTLS for smtp, imap, pop3, ftp |

### Exit Codes

| Code | Meaning |
|---|---|
| `0` | All tests passed |
| `1` | Some tests had warnings |
| `2` | Some tests had findings |

## sslyze

### Synopsis

```bash
sslyze [options] <target>
```

### Key Options

| Option | Description |
|---|---|
| `--regular` | Standard scan (recommended) |
| `--heartbleed` | Test for Heartbleed |
| `--openssl_ccs` | Test for CCS injection |
| `--robot` | Test for ROBOT attack |
| `--certinfo` | Certificate chain info |
| `--json_out <path>` | JSON output |
| `--targets_in <file>` | Batch scan from file |

## nmap SSL Scripts

| Script | Description |
|---|---|
| `ssl-enum-ciphers` | Enumerate supported cipher suites |
| `ssl-cert` | Certificate details |
| `ssl-heartbleed` | Heartbleed vulnerability |
| `ssl-poodle` | POODLE vulnerability |
| `ssl-ccs-injection` | CCS injection |

## Agent Script

```bash
# Full testssl.sh audit
node agent.js testssl example.com:443

# Vulnerability-focused scan
node agent.js testssl example.com:443 --checks vulnerable

# sslyze scan
node agent.js sslyze example.com

# nmap TLS enumeration
node agent.js nmap example.com -p 443

# HSTS check
node agent.js hsts example.com

# Quick openssl audit
node agent.js quick example.com
```
