Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I'm trying to test for a CCS Injection. I have found two prevailant methods to do so
Both are pretty simple to use, however, they are giving me different results. nmap's script gives me a STATUS: Vulnerable while Tripwire's script gives me a "No need to patch" message. What do I believe/what do I do?
Many thanks for the help.
In order to exploit the vulnerablity, a MITM attacker would effectively do the following:
o Wait for a new TLS connection, followed by the ClientHello ServerHello handshake messages.
o Issue a CCS packet in both the directions, which causes the OpenSSL code to use a zero length pre master secret key. The packet is sent to both ends of the connection. Session Keys are derived using a zero length pre master secret key, and future session keys also share this weakness.
o Renegotiate the handshake parameters.
o The attacker is now able to decrypt or even modify the packets in transit.
The script works by sending a 'ChangeCipherSpec' message out of order and checking whether the server returns an 'UNEXPECTED_MESSAGE' alert record or not. Since a non-patched server would simply accept this message, the CCS packet is sent twice, in order to force an alert from the server. If the alert type is different than 'UNEXPECTED_MESSAGE', we can conclude the server is vulnerable.
Source: https://nmap.org/nsedoc/scripts/ssl-ccs-injection.html
You can use openssl s_client in linux for sending packets to the server and confirming the vulnerability manually.
Moreover I will suggest you to use testssl.sh available on https://testssl.sh because the tool is way more comprehensive and accurate.
s_client to test manually, but you do not explain how to do that. Can you expand that part?