Sslscan Integration with DefectDojo
sslscan is an open-source command-line SSL/TLS security testing tool that queries SSL/TLS-enabled services including HTTPS, SMTP, IMAP, POP3, and FTP to enumerate supported protocol versions, cipher suites, key exchange algorithms, signature algorithms, and certificate details while testing for known vulnerabilities such as Heartbleed, renegotiation weaknesses, and TLS compression. The tool provides comprehensive security assessments with color-coded output highlighting insecure configurations including weak ciphers (NULL, RC4, 3DES), deprecated protocols (SSLv2, SSLv3), and compliance violations, delivering results in both human-readable text and XML formats for integration into security testing workflows and automated vulnerability management systems.
Data Granularity: What Gets Imported
The following fields are captured from Sslscan results and surfaced in DefectDojo findings:
| Field | Source | Notes |
|---|---|---|
| Title | Finding name from the scan | Matched to the tool's own naming |
| Severity | Critical / High / Medium / Low / Info | Mapped from the tool's own severity scale |
| Description | Finding detail from the report | Includes what the issue is and why it matters |
| Mitigation | Remediation guidance | Where the tool provides it |
Importing Into DefectDojo
Use the DefectDojo import API to create a new Test under the relevant Engagement for your product. The request body:
{
"scan_type": "Sslscan",
"engagement": "<engagement-id>",
"file": "results.json"
}