loading
Loading content
loading
Scanners
BHUSA Arsenal TLS/SSH crypto inventory with post-quantum readiness signals and CBOM-shaped output.
overview
ac-scanner is the QubitAC AC Scanner packaged for Trickest. It takes a single host or a hosts file, fingerprints TLS cryptographic exposure, assesses post-quantum readiness against NIST-era guidance, and writes structured findings (with optional CBOM-style rows) into a folder your next node can consume.
On Trickest the node is intentionally thin: pass --host for one target or --hosts for a file of host or host:port lines. Upstream AC Scanner also covers SSH auditing and richer CBOM export; the Library path focuses on the TLS/PQC pass that the PQ Crypto Surface Scanner workflow schedules after subdomain and HTTP live-host discovery.
Use it when harvest-now decrypt-later planning needs an evidence inventory, not a policy essay. Pair with subfinder and httpx when you start from a domain, or feed a known host list when inventory already exists.
use cases
Feed authorized hosts (or host:port lines) so each endpoint's TLS version, cipher, and key-exchange posture lands in findings.jsonl instead of a slide deck.
Surface classical-only stacks and hybrid PQC signals (for example X25519MLKEM768-class groups when present) so migration work orders target real endpoints.
Keep a scheduleable crypto bill of materials beside findings so the next run can produce a retest delta when certificates or edge configs change.
On the Library PQ Crypto Surface Scanner path, subfinder and httpx expand a domain, extract-hosts builds the list, ac-scanner fingerprints TLS/PQC, and report emits inventory, findings, cbom, and retest_delta.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| hosts | FILE | --hosts | File of hosts (one host or host:port per line). |
| host | STRING | --host | Single host or host:port to scan. |
Showing key inputs. ac-scanner exposes 2 inputs in total.
example
# scan a host file (one host or host:port per line)ac-scanner --hosts hosts.txt # or a single targetac-scanner --host www.example.com:443{ "tool": "ac-scanner", "host": "www.example.com", "tls_version": "TLS 1.3", "key_exchange": "x25519", "pqc_readiness": "classical-only", "severity": "high", "remediation": "Plan hybrid or PQC-capable TLS where data lifetime requires it"}guidance
Reach for ac-scanner when you need TLS and post-quantum readiness evidence on hosts you authorize. Use sslyze or testssl.sh-class tools when you only need classical TLS lab detail and do not need Arsenal PQC/CBOM-shaped output in a Trickest graph.
Deep classical TLS analysis. Strong for cipher and cert detail; not the Arsenal PQC/CBOM path used in the Collection workflow.
Fast TLS probing and enrichment on host lists. Use for broad TLS metadata; pair or switch to ac-scanner when PQC readiness and CBOM-shaped findings are the job.
Template-driven checks across many classes. Useful adjacent scans; not a dedicated crypto inventory / CBOM producer.
workflows
faq
related
Reflection triage for parameter URLs during recon.
CMS detection and version fingerprinting.
Signature-driven web application scanner.
OWASP Joomla vulnerability scanner for CMS flaws and misconfigurations.
Bundled web server checks for dangerous files and outdated software.
Bypass 403/40X restrictions through smart request manipulation.
An authorized host list feeds ac-scanner, which fingerprints TLS and post-quantum readiness and emits findings for report or retest.
Facts on this page come from the live Trickest tool library.