0

I am trying to use ncat from Kali to connect to another ncat instance running on Windows 7. The exercise requires the use of SSL.

The Windows instance is using ncat v5.59BETA which does not support the sslciphers switch to just set to ALL. The Kali box is using ncat v7.70

In my setup Kali is acting as the client and Windows as the server.

I cannot seem to find it in the documentation or man page, but how do I set the Kali ncat instance using --ssl-ciphers to use TLSv1.2?

I have looked at the packets in Wireshark and can see the protocol version error resulting from 1.0 and 1.2.

I have tried the below syntax but no luck.

root@kali:~# ncat -v target_ip 4444 --ssl-ciphers=1.2
Ncat: Version 7.70 ( https://nmap.org/ncat )
setting ciphers: 1.2
Ncat: Unable to set OpenSSL cipher list: error:1410D0B9:SSL routines:SSL_CTX_set_cipher_list:no cipher match QUITTING.
3
  • It is unclear why you want to set the ciphers in the first place since it is not required to be able to use SSL. But if you want to use it I recommend that you look into the documentation which shows how the syntax should look like and refers to the documentation of openssl ciphers for more information. 1.2 is not a valid cipher. – Steffen Ullrich Aug 15 '19 at 3:50
  • "I have looked at the packets in Wireshark and can see the protocol version error resulting from 1.0 and 1.2." - first, protocol version is a different thing than a cipher. Apart from that it is unclear what you really have seen and given the (missing) expertise with SSL you've shown so far it is not unlikely that you did not interpret your finding properly and thus try to solve it on the wrong end. – Steffen Ullrich Aug 15 '19 at 3:52
  • In particular, because of 25 years of accumulated compatibility issues, the way to determine which TLS protocol version is used by looking at a TLS handshake in wireshark is kinda complicated and definitely not what you would guess if you didn't know. The version used is the ssl.handshake.version (the value inside ServerHello just before the server's random), not the ssl.record.version. This is for 1.2. For 1.3, it's more complicated. – Z.T. Aug 15 '19 at 16:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.