#!/bin/bash
# wrapper for nmap that collects ssl information
## (c) 2023 th (at) bogus.net
PORTS="80,443,8443"
OPTIND=1
while getopts "h?p:f:" opt
do
    case "$opt" in
        h|\?)
            echo "usage: $0 [-h] [-p <port1,port2,portN>] -f <file>"
            echo " -h : this"
            echo " -p : ports to scan (default: $PORTS)"
            echo " -f : file with ip/hosts to read"
            exit 0
            ;;
        p)
            ports=$OPTARG
            ;;
        f)
            file=$OPTARG
            ;;
    esac
done

if [[ ${#ports} == 0 ]]
then
    ports=$PORTS
fi

if [[ ${#file} == 0 ]]
then
    echo "Error: need a file name" && exit 1
else
    if [[ ! -r $file ]]
    then
        echo "Error: cannot read $file" && exit 1
    fi
fi

header="----------------------------------------------------------------"
hlen=${#header}

for n in $(cat $file)
do

    padlen=$((($hlen-${#n})/2))

    pad=$(printf '%.s-' $(seq $padlen))

    echo $pad" [ "$n" ] "$pad
    result=$(host $n 2>1& > /dev/stdout)
    sleep 0.25
    if [[ $result =~ not\ found ]]
    then
        echo skip $n
    else
        echo "==> "$result
        nmap -p $PORTS --script ssl-cert $n | egrep -i '(open|closed|filtered|before|after|issuer|alter)'
        echo    
    fi
done