Scanners
Map TLS crypto exposure and post-quantum readiness on authorized hosts
BHUSA Arsenal TLS/SSH crypto inventory with post-quantum readiness signals and CBOM-shaped output.
overview
What ac-scanner does
ac-scanner is the QubitAC AC Scanner packaged for Trickest. It takes a single host or a hosts file, fingerprints TLS cryptographic exposure, assesses post-quantum readiness against NIST-era guidance, and writes structured findings (with optional CBOM-style rows) into a folder your next node can consume.
On Trickest the node is intentionally thin: pass --host for one target or --hosts for a file of host or host:port lines. Upstream AC Scanner also covers SSH auditing and richer CBOM export; the Library path focuses on the TLS/PQC pass that the PQ Crypto Surface Scanner workflow schedules after subdomain and HTTP live-host discovery.
Use it when harvest-now decrypt-later planning needs an evidence inventory, not a policy essay. Pair with subfinder and httpx when you start from a domain, or feed a known host list when inventory already exists.
use cases
Where ac-scanner fits
Inventory TLS crypto on a live host list
Feed authorized hosts (or host:port lines) so each endpoint's TLS version, cipher, and key-exchange posture lands in findings.jsonl instead of a slide deck.
Score post-quantum readiness before mandates land
Surface classical-only stacks and hybrid PQC signals (for example X25519MLKEM768-class groups when present) so migration work orders target real endpoints.
Emit CBOM-shaped rows for auditors and retests
Keep a scheduleable crypto bill of materials beside findings so the next run can produce a retest delta when certificates or edge configs change.
Run after discovery in a Trickest workflow
On the Library PQ Crypto Surface Scanner path, subfinder and httpx expand a domain, extract-hosts builds the list, ac-scanner fingerprints TLS/PQC, and report emits inventory, findings, cbom, and retest_delta.
reference
ac-scanner inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| hosts | FILE | --hosts | File of hosts (one host or host:port per line). |
| host | STRING | --host | Single host or host:port to scan. |
Showing key inputs. ac-scanner exposes 2 inputs in total.
example
Run ac-scanner
# scan a host file (one host or host:port per line)ac-scanner --hosts hosts.txt # or a single targetac-scanner --host www.example.com:443{ "tool": "ac-scanner", "host": "www.example.com", "tls_version": "TLS 1.3", "key_exchange": "x25519", "pqc_readiness": "classical-only", "severity": "high", "remediation": "Plan hybrid or PQC-capable TLS where data lifetime requires it"}guidance
Choosing ac-scanner
Reach for ac-scanner when you need TLS and post-quantum readiness evidence on hosts you authorize. Use sslyze or testssl.sh-class tools when you only need classical TLS lab detail and do not need Arsenal PQC/CBOM-shaped output in a Trickest graph.
sslyze
Deep classical TLS analysis. Strong for cipher and cert detail; not the Arsenal PQC/CBOM path used in the Collection workflow.
tlsx
Fast TLS probing and enrichment on host lists. Use for broad TLS metadata; pair or switch to ac-scanner when PQC readiness and CBOM-shaped findings are the job.
nuclei
Template-driven checks across many classes. Useful adjacent scans; not a dedicated crypto inventory / CBOM producer.
workflows
Workflows using ac-scanner
faq
ac-scanner questions
related
More Scanners tools
airixss
Reflection triage for parameter URLs during recon.
bedrock-keys-security
Black Hat Arsenal hunting for phantom IAM users behind Bedrock keys, with offline key decode and org scan.
cmseek
CMS detection and version fingerprinting.
jaeles
Signature-driven web application scanner.
joomscan
OWASP Joomla vulnerability scanner for CMS flaws and misconfigurations.
nikto
Bundled web server checks for dangerous files and outdated software.
Run ac-scanner yourself
An authorized host list feeds ac-scanner, which fingerprints TLS and post-quantum readiness and emits findings for report or retest.
Facts on this page come from the live Trickest tool library.