How to Perform Mass Scanning of Multiple Hosts Using testssl.sh: Complete Guide

Use the --file (or -iL) option to provide a text file containing one target per line, and add --mode parallel to execute concurrent scans across your infrastructure.

testssl.sh is an open-source command-line tool for auditing TLS/SSL encryption on servers. When assessing large networks, running individual commands becomes impractical; the drwetter/testssl.sh repository provides native mass testing capabilities that process host lists serially or in parallel through the --file option and associated batch-mode functions.

Understanding the --file Option for Batch Scanning

The primary mechanism for mass scanning multiple hosts with testssl.sh is the --file option, also available as the short form -iL. This accepts a plain-text file where each line represents either a simple host:port specification or a complete testssl.sh command line including additional flags.

When invoked with --file, the script automatically enables batch-mode warnings and processes entries serially by default. According to the source code in testssl.sh, the implementation reads the file and recursively invokes child processes through the create_mass_testing_cmdline and run_mass_testing functions located around lines 44-48.

Serial vs Parallel Execution Modes

By default, testssl.sh executes mass scans in serial mode, processing one target completely before starting the next. For infrastructure assessments involving many hosts, enable parallel mode using either:

• --mode parallel
• --parallel (shortcut)

In parallel mode, the script invokes the run_mass_testing_parallel function to fork multiple concurrent background processes, significantly reducing total scan time while maintaining the same output quality.

Creating Your Host List File

The input file requires Unix line endings and supports two distinct formats per the doc/testssl.1.md documentation (lines 84-90):

Simple target entries:

example.com
mail.example.org:25
192.0.2.10:443

Full command lines with options:

--wide --log example.com
--protocols --log mail.example.org:25
--cipher-per-proto --log 192.0.2.10:8443

Practical Mass Scanning Examples

Basic Serial Scanning

Create a file named hosts.txt containing your targets:

cat > hosts.txt << EOF
example.com
mail.example.org:25
192.0.2.10:443
EOF

Execute the mass scan:

testssl.sh --file hosts.txt

Parallel Mass Testing for Speed

To scan multiple hosts simultaneously and reduce total runtime:

testssl.sh --file hosts.txt --mode parallel

Or using the shortcut syntax:

testssl.sh --parallel --file hosts.txt

Processing Nmap Greppable Output Files

testssl.sh can directly parse Nmap greppable format files (generated with nmap -oG). If you have an existing Nmap scan file nmap.gnmap:

testssl.sh --file nmap.gnmap

As documented in doc/testssl.1.md (lines 86-88), the script automatically detects the Nmap header, strips extraneous columns, and retains only open ports for SSL/TLS testing.

Configuring Timeouts for Batch Reliability

When scanning large batches across unreliable networks, prevent individual scans from hanging indefinitely:

testssl.sh --file hosts.txt --openssl-timeout 30

This timeout value is passed to every child scan process, ensuring the entire mass testing operation completes even if specific targets fail to respond.

Technical Implementation Details

The mass testing functionality in drwetter/testssl.sh operates by reading the input file line-by-line and constructing child command lines. The core logic resides in three key functions within the main testssl.sh script:

• create_mass_testing_cmdline: Parses each line of the input file and constructs the appropriate command string for the child process
• run_mass_testing: Manages the serial execution flow, invoking one scan at a time
• run_mass_testing_parallel: Handles concurrent execution by forking background processes when --mode parallel is specified

These functions appear in the mass-testing code section of testssl.sh (around lines 44-48), implementing the recursive invocation pattern that enables batch processing.

Summary

• Use --file <filename> (or -iL) to enable mass scanning of multiple hosts with testssl.sh
• Input files support both simple host:port entries and complete command lines per row
• Serial mode (default) processes targets sequentially; parallel mode (--mode parallel) executes concurrent scans
• The script automatically detects and parses Nmap greppable output files (-oG format)
• Set --openssl-timeout to prevent hanging on unresponsive hosts during large batch operations
• Core implementation resides in testssl.sh functions create_mass_testing_cmdline, run_mass_testing, and run_mass_testing_parallel

Frequently Asked Questions

What file format does testssl.sh require for mass scanning?

testssl.sh expects a plain-text file with Unix line endings where each line contains either a target host (with optional port) or a complete testssl.sh command line. The create_mass_testing_cmdline function in testssl.sh parses these entries and constructs the appropriate child process commands, supporting both simple and complex specifications as documented in doc/testssl.1.md.

How does parallel mass testing work internally?

When you specify --mode parallel, testssl.sh invokes the run_mass_testing_parallel function instead of the default run_mass_testing. This function forks multiple background processes to execute scans concurrently, allowing multiple SSL/TLS handshakes to occur simultaneously and significantly reducing total runtime when assessing many hosts.

Can I use existing Nmap scan results as input for mass scanning?

Yes. testssl.sh automatically detects Nmap greppable output format (files generated with nmap -oG). As implemented in the source code and documented in doc/testssl.1.md (lines 86-88), the script strips the Nmap header and extra columns, extracting only hosts with open ports for SSL/TLS testing without requiring manual file conversion.

Why should I set a timeout when performing mass scans?

The --openssl-timeout parameter prevents individual scans from hanging indefinitely on unresponsive or firewalled hosts, which is critical when processing large batches. This timeout is applied to every child scan process forked during mass testing, ensuring that one slow or unresponsive target cannot block the completion of the entire batch operation.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}