0

I'm trying to connect to multiple hosts that have Self-signed certificates on https to grab html title and headers but i'm getting errors reference:StackTrace but when i do the same on other hosts with signed certificates it works perfectly i checked a few forums but couldn't find anything that could fix my problem.

openssl version

OpenSSL 1.1.1f 31 Mar 2020 built on: Mon Apr 20 11:53:50 2020 UTC platform: debian-amd64 options: bn(64,64) rc4(8x,int) des(int) blowfish(ptr) compiler: gcc -fPIC -pthread -m64 -Wa,--noexecstack -Wall -Wa,--noexecstack -g -O2 -fdebug-prefix-map=/build/openssl-P_ODHM/openssl-1.1.1f=. -fstack-protector-strong -Wformat -Werror=format-security -DOPENSSL_TLS_SECURITY_LEVEL=2 -DOPENSSL_USE_NODELETE -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM -DNDEBUG -Wdate-time -D_FORTIFY_SOURCE=2 OPENSSLDIR: "/usr/lib/ssl" ENGINESDIR: "/usr/lib/x86_64-linux-gnu/engines-1.1" Seeding source: os-specific

main.py

#!/usr/bin/env python3 #coding:utf-8 from termcolor import colored from bs4 import BeautifulSoup import argparse import socket import json import ssl import sys parser = argparse.ArgumentParser() parser.add_argument("-i", "--ip", help = "<inputIP>") parser.add_argument("-p", "--port", help = "The port to which you want to receive a response from") if len(sys.argv)==1: parser.print_help() sys.exit(1) args = parser.parse_args() IP = str(args.ip) port = int(args.port) context = ssl.SSLContext(ssl.PROTOCOL_TLS) context.verify_mode = ssl.CERT_NONE ssock = context.wrap_socket(socket.socket()) socket.setdefaulttimeout(0.5) ssock.connect((IP, port)) hostname = socket.getfqdn(IP) request = ("GET / HTTP/1.1\r\nHost: " + IP + "\r\nUser-Agent: Mozilla/5.0\r\nAccept: */*\r\n\r\n").encode('utf-8') ssock.sendall(request) while True: response = ssock.recv(2048).decode('utf-8') if ( len(response) < 1 ): break (headers, body) = response.split("\r\n\r\n") soup = BeautifulSoup(body, 'html.parser') if hostname == IP: print(colored(IP, 'green'), colored(port, 'yellow'), colored(soup.title.string, 'blue'), json.dumps(headers)) else: print(colored(IP, 'green'), colored(port, 'yellow'), colored(hostname, 'magenta'), colored(soup.title.string, 'blue'), json.dumps(headers)) ssock.close()

StackTrace:

Traceback (most recent call last): File "./https.py", line 30, in <module> ssock.connect((IP, port)) File "/usr/lib/python3.8/ssl.py", line 1342, in connect self._real_connect(addr, False) File "/usr/lib/python3.8/ssl.py", line 1333, in _real_connect self.do_handshake() File "/usr/lib/python3.8/ssl.py", line 1309, in do_handshake self._sslobj.do_handshake() ssl.SSLError: [SSL: SSLV3_ALERT_HANDSHAKE_FAILURE] sslv3 alert handshake failure (_ssl.c:1108) ^[[DTraceback (most recent call last): File "./https.py", line 30, in <module> ssock.connect((IP, port)) File "/usr/lib/python3.8/ssl.py", line 1342, in connect self._real_connect(addr, False) File "/usr/lib/python3.8/ssl.py", line 1329, in _real_connect super().connect(addr) TimeoutError: [Errno 110] Connection timed out Traceback (most recent call last): File "./https.py", line 30, in <module> ssock.connect((IP, port)) File "/usr/lib/python3.8/ssl.py", line 1342, in connect self._real_connect(addr, False) File "/usr/lib/python3.8/ssl.py", line 1333, in _real_connect self.do_handshake() File "/usr/lib/python3.8/ssl.py", line 1309, in do_handshake self._sslobj.do_handshake() ssl.SSLError: [SSL: UNSUPPORTED_PROTOCOL] unsupported protocol (_ssl.c:1108)
Improve this question
8
  • Given that it works for other hosts it is likely the host in question does not support TLS on this specific IP and port, requires SNI, does not support the TLS version etc. More can only be said if the specific IP and port is known which causes the trouble. Commented Oct 6, 2020 at 17:40
  • tried to access those host in firefox and it works it just dosen't seem to work in python Commented Oct 6, 2020 at 17:47
  • Did you access the host in Firefox by IP address or by domain name? Commented Oct 6, 2020 at 17:55
  • accessed it by ip Commented Oct 6, 2020 at 18:04
  • Is the server accessible from public and can you provide the details so that one can have a further look? Commented Oct 6, 2020 at 18:16

1 Answer 1

Reset to default
1

From the list you provide only three IP addresses fail: 194.224.179.234, 124.65.100.3 fail with "unsupported protocol" while 114.6.128.61 fails with "dh key too small". The reason for these problems is a hardening done in recent versions of Debian (and Ubuntu) to increase the security requirements of TLS, for example by disabling TLS 1.0.

But the three IP addresses in question don't work with the increased security requirements, i.e. they require the disabled TLS 1.0 or have other less secure requirements. To downgrade the security settings for a specific TLS context set the security level to 1:

context = ssl.SSLContext(ssl.PROTOCOL_TLS) context.set_ciphers('DEFAULT:@SECLEVEL=1')

With these settings it works for me with all IP addresses you've provided.

Improve this answer
Sign up to request clarification or add additional context in comments.

Comments