<?php
	echo "<h2>Get Alternate Names for Certificate</h2>
		Writeup: <a href='http://andrewmohawk.com/2012/05/21/alternate-dns-names-in-certificates/'>http://andrewmohawk.com/2012/05/21/alternate-dns-names-in-certificates/</a><br/><br/>
		<form action='index.php'>
		<strong>HTTPS enabled site: https://</strong><input type='text' name='h'/><br/>
		<input type='submit' value='Lookup!'/><br/>
		</form>
		";
	if(isset($_GET["h"]))
	{
		echo "<pre>";
		set_time_limit(0); 
		ob_implicit_flush();
		$host = $_GET["h"];
		$context = stream_context_create(array(
		  'ssl' => array('capture_peer_cert' => TRUE)
		));
		echo "[+] Fetching SSL Cert...";
		@$html = file_get_contents('https://'.$host, NULL, $context);
		$opts = stream_context_get_options($context);
		echo "Done<br/>";
		echo "[+] Parsing SSL Cert...<br/>";
		if(isset($opts["ssl"]) && isset($opts['ssl']['peer_certificate']))
		{
			$ssl = openssl_x509_parse($opts['ssl']['peer_certificate']);
			if(isset($ssl["extensions"]))
			{
				if(isset($ssl["extensions"]["subjectAltName"]))
				{
					echo " [-] Found Alternate DNS names:<br/>";
					$altNamesTmp = $ssl["extensions"]["subjectAltName"];
					$altNames = explode(",",$altNamesTmp);
					$hostnames = array();
					$unknown = array();
					foreach($altNames as $a)
					{
						if(strpos($a,"DNS:") !== false)
						{
							
							$hostname = substr($a,strpos($a,"DNS:")+4);
							
							$hostnames[] = $hostname;
							
							
						}
						else
						{
							$unknown[] = $a;
						}
						
					}
					foreach(array_unique($hostnames) as $ud)
					{
						echo " [*] Found Alternate DNS Name: $ud <br/>";
					}
					foreach(array_unique($unknown) as $ud)
					{
						echo " [*] Unknown Entry: $ud <br/>";
					}
				}
			}
		}
		else
		{
			echo "[!] Could not parse certificate... https enabled?";
		}
	}
