I'm running nmap 6.47 on Windows 7 and am trying to run the ssl-ccs-injection.nse script. After getting an error, I ran it with the -d (debug) option and the error in the subject is what showed up. I haven't ever tried to run this script before, and I'm wondering what I've missed.

Here's a sanitized copy of the session along with the errors, I've replaced the hostname with example.com and used for its IP.

nmap -p 443 -d --script ssl-ccs-injection.nse --script-args vulns.showall example.com

Starting Nmap 6.47 ( http://nmap.org ) at 2015-02-24 10:17 Eastern Standard Time
Winpcap present, dynamic linked to: WinPcap version 4.1.3 (packet.dll version, based on libpcap version 1.0 branch 1_0_rel0b (20091008)
--------------- Timing report ---------------
  hostgroups: min 1, max 100000
  rtt-timeouts: init 1000, min 100, max 10000
  max-scan-delay: TCP 1000, UDP 1000, SCTP 1000
  parallelism: min 0, max 0
  max-retries: 10, host-timeout: 0
  min-rate: 0, max-rate: 0
NSE: Using Lua 5.2.
NSE: Script Arguments seen from CLI: vulns.showall
NSE: Loaded 1 scripts for scanning.
NSE: Script Pre-scanning.
NSE: Starting runlevel 1 (of 1) scan.
Initiating Ping Scan at 10:17
Scanning example.com ( [4 ports]
Packet capture filter (device eth2): dst host and (icmp or icmp6 or ((tcp or udp or sctp) and (src host
We got a TCP ping packet back from port 443 (trynum = 0)
Completed Ping Scan at 10:17, 0.42s elapsed (1 total hosts)
Overall sending rates: 9.43 packets / s, 358.49 bytes / s.
mass_rdns: Using DNS server
mass_rdns: Using DNS server
mass_rdns: Using DNS server
mass_rdns: Using DNS server
mass_rdns: Using DNS server
mass_rdns: Using DNS server
Initiating Parallel DNS resolution of 1 host. at 10:17
mass_rdns: 1.93s 0/1 [#: 6, OK: 0, NX: 0, DR: 0, SF: 0, TR: 1]
Completed Parallel DNS resolution of 1 host. at 10:17, 0.02s elapsed
DNS resolution of 1 IPs took 1.93s. Mode: Async [#: 6, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0]
Initiating SYN Stealth Scan at 10:17
Scanning example.com ( [1 port]
Packet capture filter (device eth2): dst host and (icmp or icmp6 or ((tcp or udp or sctp) and (src host
Discovered open port 443/tcp on
Completed SYN Stealth Scan at 10:17, 0.36s elapsed (1 total ports)
Overall sending rates: 2.77 packets / s, 121.88 bytes / s.
NSE: Script scanning
NSE: Starting runlevel 1 (of 1) scan.
NSE: Starting ssl-ccs-injection against example.com (
Initiating NSE at 10:17
NSE: ssl-ccs-injection against example.com ( threw an error!
C:\Program Files (x86)\Nmap/scripts\ssl-ccs-injection.nse:123: variable 'keys' is not declared
stack traceback:
    [C]: in function 'error'
    C:\Program Files (x86)\Nmap/nselib/strict.lua:80: in function '__index'
    C:\Program Files (x86)\Nmap/scripts\ssl-ccs-injection.nse:123: in function 'test_ccs_injection'
    C:\Program Files (x86)\Nmap/scripts\ssl-ccs-injection.nse:269: in function <C:\Program Files (x86)\Nmap/scripts\ssl-ccs-injection.nse:245>
    (...tail calls...)
Completed NSE at 10:17, 0.00s elapsed
Nmap scan report for example.com (
Host is up, received syn-ack (0.28s latency).
Scanned at 2015-02-24 10:17:12 Eastern Standard Time for 3s
443/tcp open  https   syn-ack
Final times for host: srtt: 284875 rttvar: 227250  to: 1193875
NSE: Script Post-scanning.
NSE: Starting runlevel 1 (of 1) scan.
Read from C:\Program Files (x86)\Nmap: nmap-payloads nmap-services.
Nmap done: 1 IP address (1 host up) scanned in 3.92 seconds
           Raw packets sent: 5 (196B) | Rcvd: 2 (88B)

What's going on?

  • Looks like an error with the script. Contact the maintainer, because that's a syntax error.
    – Ohnana
    Feb 24, 2015 at 16:33
  • What's on line 123 of ssl-ccs-injection.nse ?
    – kalina
    Feb 24, 2015 at 18:21
  • Have you tried running that script without the "script-args" directive?
    – schroeder
    Feb 24, 2015 at 19:09
  • @Flyk line 123 calls stdnse.keys(), which is supposed to be part of the standard NSE library, but it's seeing it as a variable, and not a function. It looks like an internal nmap problem. Tho, I'd try not using the "script-args" directive.
    – schroeder
    Feb 24, 2015 at 19:22
  • @Flyk: Here's the line: ["ciphers"] = stdnse.keys(tls.CIPHERS), schroeder: Yep, tried without that directive. Feb 24, 2015 at 19:31

2 Answers 2


The script is written for the current development version of Nmap, not the released version. In r33651, I moved several different implementations of the same function into the stdnse library. You should be able to copy that library into your nselib/ directory just like you did to copy the ssl-ccs-injection script into the scripts/ directory. This will also solve the further problems of the same sort you may run into involving the debug function.

EDIT: The ssl-ccs-injection script was released with Nmap 6.49BETA1, and is available in stable releases after that (such as Nmap 7.01).

  • 1
    Thanks, I can confirm that using the updated stdnse library allowed the script to work properly. Feb 24, 2015 at 20:58
  • This worked for me as well. One thing to note, the example usage says nmap --script ssh2-enum-algos target, but I had to include service scanning to meet the dependencies for the check by adding -sV.
    – freb
    Jun 11, 2015 at 1:36

Looking at the ssl-ccs-injection.nse Lua code:

local stdnse = require('stdnse')
... (snip) ...
local function test_ccs_injection(host, port, version)
  local hello = tls.client_hello({
    ["protocol"] = version,
    -- Claim to support every cipher
    -- Doesn't work with IIS, but IIS isn't vulnerable
    ["ciphers"] = stdnse.keys(tls.CIPHERS),              --< LINE 123
    ["compressors"] = {"NULL"},

It appears there is an internal problem with the Lua script interpreter. It's not seeing the stdnse.keys() function properly.

I would try updating or re-installing nmap and/or this one script.

  • I've re-installed nmap already and have tried re-downloading the script. I even built a Kali Linux Live ISO and downloaded the script (I'm not sure why it's not included) and I get the same error. I'm assuming that it's a script issue and I am attempting to get help via the [email protected], but the mailing list seems to be taking a long time to allow me to subscribe. I'm wondering if anyone else has this and if so, if it runs? I'm thinking that I need to configure something somewhere perhaps. Feb 24, 2015 at 19:42
  • Then it looks like an internal nmap coding issue.
    – schroeder
    Feb 24, 2015 at 19:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .