enumerate ciphers based on security level and optimizations #177

tarunKoyalwar · 2023-01-31T15:34:56Z

Proposed Changes

refactor and optimize cipher enum logic
color code cipher results based on security level
adds option to specify cipher levels while enumerating ciphers

   -ct, -cipher-type value  ciphers types to enumerate (all/secure/insecure/weak) (default 0)

closes #169

pkg/tlsx/tls/tls.go

+		if err != nil {
+			return enumeratedCiphers, errorutil.NewWithErr(err).WithTag("ctls")
+		}
+		baseCfg.CipherSuites = []uint16{tlsCiphers[v]}


pkg/tlsx/tls/tls.go

+		if err != nil {
+			return nil, errorutil.NewWithTag("ctls", "could not get tls ciphers").Wrap(err)
+		}
+		c.tlsConfig.CipherSuites = customCiphers


pkg/tlsx/tls/tls.go

pkg/tlsx/ztls/ztls.go

 	}
+	defer conn.Close() //internally done by conn.Close() so just a placeholder


tarunKoyalwar · 2023-02-14T14:38:46Z

$ ./tlsx -u scanme.sh -sm openssl -ce -v
  

  _____ _    _____  __
 |_   _| |  / __\ \/ /
   | | | |__\__ \>  < 
   |_| |____|___/_/\_\	v1.0.5

		projectdiscovery.io

[INF] Processing input scanme.sh:443
[LibreSSL3.6.1] Starting cipher enumeration with 48 ciphers in tls12
[LibreSSL3.6.1] Starting cipher enumeration with 48 ciphers in tls10
[LibreSSL3.6.1] Starting cipher enumeration with 48 ciphers in tls11
scanme.sh:443 [tls12] [ECDHE-ECDSA-CHACHA20-POLY1305,ECDHE-ECDSA-AES256-GCM-SHA384,ECDHE-ECDSA-AES256-SHA,ECDHE-ECDSA-AES128-GCM-SHA256,ECDHE-ECDSA-AES128-SHA]
scanme.sh:443 [tls10] [ECDHE-ECDSA-AES256-SHA,ECDHE-ECDSA-AES128-SHA]
scanme.sh:443 [tls11] [ECDHE-ECDSA-AES256-SHA,ECDHE-ECDSA-AES128-SHA]

tarunKoyalwar · 2023-02-14T14:40:07Z

cmd/update-cipherstatus/main.go

+	if err != nil {
+		log.Fatal(err)
+	}
+	defer res.Body.Close()


cmd/update-cipherstatus/main.go

+}
+
+func FetchAndLoadCiphers(url string) {
+	res, err := http.Get(url)


Mzack9999

lgtm. todo:

Few suggested changes
merge conflicts

assets/cipherstatus_data.go

cmd/update-cipherstatus/main.go

Mzack9999

Nil crash if the tls engine is not specified:

$ go run -u scanme.sh -ce -v            
panic: runtime error: invalid memory address or nil pointer dereference
[signal 0xc0000005 code=0x0 addr=0x8 pc=0x7ff724e30660]

goroutine 38 [running]:
github.com/projectdiscovery/tlsx/pkg/tlsx/openssl.(*Client).getOpenSSLopts(0x0, {0xc0003c7fc0, 0x9}, {0x0, 0x0}, {0x7ff7251e1691, 0x3}, {{0x0, 0x0}, {0x7ff7251e4bda, ...}, ...})
        C:/Users/marco/go/src/github.com/projectdiscovery/tlsx/pkg/tlsx/openssl/openssl.go:142 +0x120
github.com/projectdiscovery/tlsx/pkg/tlsx/openssl.(*Client).EnumerateCiphers(0xc00038a240?, {0xc0003c7fc0, 0x9}, {0x0, 0x0}, {0x7ff7251e1691, 0x3}, {{0x0, 0x0}, {0x7ff7251e4bda, ...}, ...})
        C:/Users/marco/go/src/github.com/projectdiscovery/tlsx/pkg/tlsx/openssl/openssl.go:110 +0x13d
github.com/projectdiscovery/tlsx/pkg/tlsx/auto.(*Client).EnumerateCiphers.func1({0x7ff725386d38?, 0x0?})
        C:/Users/marco/go/src/github.com/projectdiscovery/tlsx/pkg/tlsx/auto/auto.go:79 +0xf8
created by github.com/projectdiscovery/tlsx/pkg/tlsx/auto.(*Client).EnumerateCiphers
        C:/Users/marco/go/src/github.com/projectdiscovery/tlsx/pkg/tlsx/auto/auto.go:77 +0x375
exit status 2

tarunKoyalwar · 2023-02-16T09:02:10Z

@Mzack9999 I am not able to reproduce the panic ? can you verify it again with latest commit

$ go run . -u scanme.sh -ce -v                                                            1 ↵
  

  _____ _    _____  __
 |_   _| |  / __\ \/ /
   | | | |__\__ \>  < 
   |_| |____|___/_/\_\	v1.0.5

		projectdiscovery.io

[INF] Processing input scanme.sh:443
[ztls] Starting cipher enumeration with 345 ciphers in tls12
[LibreSSL3.6.1] Starting cipher enumeration with 48 ciphers in tls12
[ctls] Starting cipher enumeration with 28 ciphers and version tls12
[ztls] Starting cipher enumeration with 345 ciphers in tls10
[ctls] Starting cipher enumeration with 28 ciphers and version tls10
[LibreSSL3.6.1] Starting cipher enumeration with 48 ciphers in tls10
[ctls] Starting cipher enumeration with 28 ciphers and version tls11
[ztls] Starting cipher enumeration with 345 ciphers in tls11
[LibreSSL3.6.1] Starting cipher enumeration with 48 ciphers in tls11
scanme.sh:443 [tls12] [TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,ECDHE-ECDSA-CHACHA20-POLY1305,ECDHE-ECDSA-AES256-GCM-SHA384,ECDHE-ECDSA-AES256-SHA,ECDHE-ECDSA-AES128-GCM-SHA256,ECDHE-ECDSA-AES128-SHA]
scanme.sh:443 [tls10] [TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,ECDHE-ECDSA-AES256-SHA,ECDHE-ECDSA-AES128-SHA]
scanme.sh:443 [tls11] [TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,ECDHE-ECDSA-AES256-SHA,ECDHE-ECDSA-AES128-SHA]
[INF] Connections made using crypto/tls: 89, zcrypto/tls: 1035, openssl: 144

Mzack9999 · 2023-02-16T19:05:34Z

@tarunKoyalwar I think we should add openssl only if it's available on the system in auto.go => EnumerateCiphers

allClients := []clients.Implementation{c.opensslClient, c.tlsClient, c.ztlsClient}

Otherwise, it will face nil pointer exceptions

tarunKoyalwar · 2023-02-16T19:06:54Z

@Mzack9999 , thanks for pointing it out

ehsandeep

@tarunKoyalwar, do you think it would be a good idea to update json output to differentiate cipher types?

....
{
  "version": "tls11",
  "ciphers": {
    "weak": [
      "ECDHE-RSA-AES256-SHA",
      "CAMELLIA128-SHA",
      "ECDHE-RSA-DES-CBC3-SHA",
      "DES-CBC3-SHA"
    ],
    "secure": [
      "ECDHE-RSA-AES256-SHA",
      "DHE-RSA-AES256-SHA",
      "DES-CBC3-SHA"
    ]
  }
}

tarunKoyalwar · 2023-02-20T15:20:27Z

$ ./tlsx -u scanme.sh -ce -v -sm openssl 
  

  _____ _    _____  __
 |_   _| |  / __\ \/ /
   | | | |__\__ \>  < 
   |_| |____|___/_/\_\	v1.0.5

		projectdiscovery.io

[INF] Processing input scanme.sh:443
[INF] Started TLS Cipher Enumeration using openssl mode
[LibreSSL3.3.6] Starting cipher enumeration with 48 ciphers in tls12
[LibreSSL3.3.6] Starting cipher enumeration with 48 ciphers in tls10
[LibreSSL3.3.6] Starting cipher enumeration with 48 ciphers in tls11
[tls12] [ECDHE-ECDSA-AES256-SHA,ECDHE-ECDSA-AES128-SHA,ECDHE-ECDSA-CHACHA20-POLY1305,ECDHE-ECDSA-AES256-GCM-SHA384,ECDHE-ECDSA-AES128-GCM-SHA256]
[tls10] [ECDHE-ECDSA-AES256-SHA,ECDHE-ECDSA-AES128-SHA]
[tls11] [ECDHE-ECDSA-AES256-SHA,ECDHE-ECDSA-AES128-SHA]

$ ./tlsx -u scanme.sh -ce  -sm openssl -silent  -json | jq 
{
  "timestamp": "2023-02-20T20:44:29.360091+05:30",
  "host": "scanme.sh",
  "ip": "128.199.158.128",
  "port": "443",
  "probe_status": true,
  "tls_version": "tls12",
  "cipher": "ECDHE-ECDSA-CHACHA20-POLY1305",
  "self_signed": true,
  "mismatched": true,
  "not_before": "2022-06-07T15:18:51Z",
  "not_after": "2032-06-04T15:18:51Z",
  "subject_dn": "CN=scanme, O=pd",
  "subject_cn": "scanme",
  "subject_org": [
    "pd"
  ],
  "issuer_dn": "CN=scanme, O=pd",
  "issuer_cn": "scanme",
  "issuer_org": [
    "pd"
  ],
  "fingerprint_hash": {
    "md5": "eacf1e9b4acca9168b43f84a9bfaa7c5",
    "sha1": "550837ef878d58c92820e9498e3807c6bd7184ec",
    "sha256": "ebbf69a9e7ba65b51fa12cd44105055c2c2c250706e9795fab219d3d5dff5fac"
  },
  "tls_connection": "openssl",
  "sni": "scanme.sh",
  "version_enum": [
    "tls12",
    "tls10",
    "tls11"
  ],
  "cipher_enum": [
    {
      "version": "tls12",
      "ciphers": {
        "weak": [
          "ECDHE-ECDSA-AES256-SHA",
          "ECDHE-ECDSA-AES128-SHA"
        ],
        "secure": [
          "ECDHE-ECDSA-CHACHA20-POLY1305",
          "ECDHE-ECDSA-AES256-GCM-SHA384",
          "ECDHE-ECDSA-AES128-GCM-SHA256"
        ]
      }
    },
    {
      "version": "tls10",
      "ciphers": {
        "weak": [
          "ECDHE-ECDSA-AES256-SHA",
          "ECDHE-ECDSA-AES128-SHA"
        ]
      }
    },
    {
      "version": "tls11",
      "ciphers": {
        "weak": [
          "ECDHE-ECDSA-AES256-SHA",
          "ECDHE-ECDSA-AES128-SHA"
        ]
      }
    }
  ]
}

ehsandeep

missing input hostname in output
removing unused -ac option

tarunKoyalwar · 2023-02-21T15:05:15Z

./tlsx -u scanme.sh -ce -v -sm openssl
  

  _____ _    _____  __
 |_   _| |  / __\ \/ /
   | | | |__\__ \>  < 
   |_| |____|___/_/\_\	v1.0.5

		projectdiscovery.io

[INF] Processing input scanme.sh:443
[INF] Started TLS Cipher Enumeration using openssl mode
[LibreSSL3.3.6] Starting cipher enumeration with 48 ciphers in tls12
[LibreSSL3.3.6] Starting cipher enumeration with 48 ciphers in tls10
[LibreSSL3.3.6] Starting cipher enumeration with 48 ciphers in tls11
scanme.sh:443 [tls12] [ECDHE-ECDSA-AES256-SHA,ECDHE-ECDSA-AES128-SHA,ECDHE-ECDSA-CHACHA20-POLY1305,ECDHE-ECDSA-AES256-GCM-SHA384,ECDHE-ECDSA-AES128-GCM-SHA256]
scanme.sh:443 [tls10] [ECDHE-ECDSA-AES256-SHA,ECDHE-ECDSA-AES128-SHA]
scanme.sh:443 [tls11] [ECDHE-ECDSA-AES256-SHA,ECDHE-ECDSA-AES128-SHA]

tarunKoyalwar · 2023-02-21T15:07:51Z

@ehsandeep ,

Non-Breaking Changes

remove flag -ac i.e all-ciphers
marked Options.AllCiphers as deprecated to avoid breaking changes
-This will be detected by golangci in any project/repo that uses above option

pkg/tlsx/tls/tls.go

+	} else {
+		// unless explicitly specified client should advertise all supported ciphers
+		// Note: Go stdlib by default only advertises a safe/default list of ciphers
+		c.tlsConfig.CipherSuites = AllCiphers


ehsandeep

./tlsx -u scanme.sh -ce -sm openssl
  

  _____ _    _____  __
 |_   _| |  / __\ \/ /
   | | | |__\__ \>  < 
   |_| |____|___/_/\_\	v1.0.5

		projectdiscovery.io

[INF] Started TLS Cipher Enumeration using openssl mode
scanme.sh:443 [tls12] [ECDHE-ECDSA-AES256-SHA,ECDHE-ECDSA-AES128-SHA,ECDHE-ECDSA-CHACHA20-POLY1305,ECDHE-ECDSA-AES256-GCM-SHA384,ECDHE-ECDSA-AES128-GCM-SHA256]
scanme.sh:443 [tls10] [ECDHE-ECDSA-AES256-SHA,ECDHE-ECDSA-AES128-SHA]
scanme.sh:443 [tls11] [ECDHE-ECDSA-AES256-SHA,ECDHE-ECDSA-AES128-SHA]

sonarqubecloud · 2023-02-21T15:28:06Z

SonarCloud Quality Gate failed.

0 Bugs
4 Vulnerabilities
0 Security Hotspots
4 Code Smells

9.7% Coverage
15.6% Duplication

refactor and optimize cipher enum

310802c

tarunKoyalwar marked this pull request as draft January 31, 2023 15:35

github-advanced-security bot found potential problems Jan 31, 2023

View reviewed changes

pkg/tlsx/tls/tls.go Fixed Show fixed Hide fixed

pkg/tlsx/ztls/ztls.go Fixed Show fixed Hide fixed

Merge branch 'dev' into issue-169-insecure-ciphers

71b1bb5

github-advanced-security bot found potential problems Feb 12, 2023

View reviewed changes

tarunKoyalwar added 2 commits February 14, 2023 19:53

cipher enum based on sec level

7c8fdc9

resolve merge conflicts

53b7ea3

tarunKoyalwar linked an issue Feb 14, 2023 that may be closed by this pull request

Enumerate Ciphers based on security level (weak ,secure , insecure etc ) #169

Closed

github-advanced-security bot found potential problems Feb 14, 2023

View reviewed changes

tarunKoyalwar marked this pull request as ready for review February 14, 2023 14:42

tarunKoyalwar requested review from Mzack9999 and ehsandeep February 14, 2023 14:44

add acknowledgements to README.md

c3802a0

tarunKoyalwar self-assigned this Feb 14, 2023

Mzack9999 requested changes Feb 15, 2023

View reviewed changes

assets/cipherstatus_data.go Outdated Show resolved Hide resolved

cmd/update-cipherstatus/main.go Outdated Show resolved Hide resolved

tarunKoyalwar added 2 commits February 15, 2023 22:37

use gologger

b669104

resolve merge conflicts

0da3b74

tarunKoyalwar requested a review from Mzack9999 February 15, 2023 17:16

Mzack9999 requested changes Feb 15, 2023

View reviewed changes

increment conn counter

b1ada09

tarunKoyalwar requested a review from Mzack9999 February 16, 2023 09:07

fix nil panic & add Info

247d4cb

Mzack9999 approved these changes Feb 17, 2023

View reviewed changes

misc option update

621fcc1

ehsandeep reviewed Feb 18, 2023

View reviewed changes

tarunKoyalwar mentioned this pull request Feb 20, 2023

Create a common update group supporting self-update options (#103) projectdiscovery/goflags#107

Closed

tarunKoyalwar added 2 commits February 20, 2023 20:46

update cipher_enum format in json

5d399be

resolve merge conflicts

f18802d

tarunKoyalwar requested a review from ehsandeep February 20, 2023 15:33

ehsandeep requested changes Feb 20, 2023

View reviewed changes

deprecate and fix missing hostname

679ce10

github-advanced-security bot found potential problems Feb 21, 2023

View reviewed changes

tarunKoyalwar requested a review from ehsandeep February 21, 2023 15:10

Merge branch 'dev' into issue-169-insecure-ciphers

ce85a1e

ehsandeep approved these changes Feb 21, 2023

View reviewed changes

ehsandeep merged commit efc2df4 into dev Feb 21, 2023

ehsandeep deleted the issue-169-insecure-ciphers branch February 21, 2023 15:27

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

enumerate ciphers based on security level and optimizations #177

enumerate ciphers based on security level and optimizations #177

tarunKoyalwar commented Jan 31, 2023 •

edited by ehsandeep

Loading

tarunKoyalwar commented Feb 14, 2023

tarunKoyalwar commented Feb 14, 2023

Mzack9999 left a comment •

edited by tarunKoyalwar

Loading

Mzack9999 left a comment

tarunKoyalwar commented Feb 16, 2023

Mzack9999 commented Feb 16, 2023

tarunKoyalwar commented Feb 16, 2023 •

edited

Loading

ehsandeep left a comment

tarunKoyalwar commented Feb 20, 2023

ehsandeep left a comment •

edited

Loading

tarunKoyalwar commented Feb 21, 2023

tarunKoyalwar commented Feb 21, 2023

ehsandeep left a comment

sonarqubecloud bot commented Feb 21, 2023

		}
		defer conn.Close() //internally done by conn.Close() so just a placeholder

enumerate ciphers based on security level and optimizations #177

enumerate ciphers based on security level and optimizations #177

Conversation

tarunKoyalwar commented Jan 31, 2023 • edited by ehsandeep Loading

Proposed Changes

tarunKoyalwar commented Feb 14, 2023

tarunKoyalwar commented Feb 14, 2023

Mzack9999 left a comment • edited by tarunKoyalwar Loading

Choose a reason for hiding this comment

Mzack9999 left a comment

Choose a reason for hiding this comment

tarunKoyalwar commented Feb 16, 2023

Mzack9999 commented Feb 16, 2023

tarunKoyalwar commented Feb 16, 2023 • edited Loading

ehsandeep left a comment

Choose a reason for hiding this comment

tarunKoyalwar commented Feb 20, 2023

ehsandeep left a comment • edited Loading

Choose a reason for hiding this comment

tarunKoyalwar commented Feb 21, 2023

tarunKoyalwar commented Feb 21, 2023

Non-Breaking Changes

ehsandeep left a comment

Choose a reason for hiding this comment

sonarqubecloud bot commented Feb 21, 2023

tarunKoyalwar commented Jan 31, 2023 •

edited by ehsandeep

Loading

Mzack9999 left a comment •

edited by tarunKoyalwar

Loading

tarunKoyalwar commented Feb 16, 2023 •

edited

Loading

ehsandeep left a comment •

edited

Loading