In the context of SSL/TLS protocol and SLOTH vulnerability. I want to find out if certain websites(webservers) or applications that use TLS are vulnerable. I need some guidance for this.
My idea is to develop/find a tool(maybe openssl) that connects to the servers and in the client hello asks for RSA-MD5 SignatureAndHashAlgorithm to test if the server sends the corresponding certificate under this configuration and conclude that the server is vulnerable.
Likewise for the client certificates, I want to ask for client certificates signed by RSA-MD5 and if the client sends its certificates under this setup I'll conclude that the client is vulnerable to SLOTH.
First, is my approach right? or am I off the road?
Second, what types of tools do I need to use? Is openssl capable of producing such requests and responses?