The baseline Debian openssl package has been patched to disable SSLv2 due to its inherent insecurity. While this makes perfect sense for a server distro, it is completely inappropriate to have the ability to connect to insecure servers (using SSLv2) disabled on a pentesting distro. Part of what Kali is used for is exploiting vulnerable protocols, so using the mainstream Debian package where SSLv2 is disabled is contrary to the main use case of the distro.

Issue 0000146 was closed because a single tool (sslscan) was modified to use static libraries with SSLv2 support enabled. A note was left on that issue that it should be reopened if other apps that needed the libraries were identified.

It is important here to recognize that identifying the use of SSLv2 on a server is good, but that identifying high level vulnerabilities aside from that is still required. The problem is that all of the apps that can be used to connect over SSL need to function with SSLv2. For (incomplete) example:

• every scripting language that an exploit could be written in (i.e., ruby, python, perl, lua, etc.)
• curl
• wget
• web browsers

As it stands, we have had to rebuild the openssl package and rebuild curl and ruby against those libraries to support our common needs. Obviously, these are steps that shouldn't be needed with a pentesting distro.