login domains

[tomhung]

Just because the main domain is safe does not mean the domain they use for their logins/secure area is safe.

[musalbas]

That is true.

[janbrennen]

Or, vice versa: currently yahoo.com is vulnerable, whereas mail.yahoo.com no longer is

[range]

On the other hand only SLDs are tested and might not have SSL enabled, while subdomains do have SSL enabled and might be vulnerable. I found that while checking for our domain, which is listed as "no SSL", while our www. and other subdomains actually do have SSL enabled.

[musalbas]

Indeed, the main inaccuracy of this scan is that subdomains weren't tested. I should have also tested www.*, but it is a little too late for that as 70%+ of the sites found to be vulnerable in the first scan are no longer vulnerable.

I stated in the readme: 'Please note that subdomains aren't tested, so sites that don't have SSL on their main domain will appear as "no SSL"'.

[tomhung]

How about a list of the top 10,000 login urls!