Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Retire HTTPSInfo / TLS Debug

See original GitHub issue

Describe the bug When checking the TLS ciphers using HTTPSInfo the first line reports a StringIndexOutOfBoundsException error and then only shows a few of the actual ciphers on the web server, and none of the TLS1.3 ciphers.

An exception occurred while updating the General panel. Problem fetching certificate. err=java.lang.StringIndexOutOfBoundsException: begin 4, end -1, length 22Cipher Suites Supported: TLS_DHE_RSA_WITH_AES_256_GCM_SHA384(0x9f)(MEDIUM,TLSv1.2) TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256(0xc02f)(STRONG,TLSv1.2) TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384(0xc030)(STRONG,TLSv1.2) TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256(0xcca8)(STRONG,TLSv1.2)

To Reproduce Steps to reproduce the behavior:

Go to ‘a URL in the sites panel’
Right Click on ‘one of the URL and choose HTTPSInfo’
Move to the HTTPSInfo tab
See error ::
An exception occurred while updating the General panel. Problem fetching certificate. err=java.lang.StringIndexOutOfBoundsException: begin 4, end -1, length 22Cipher Suites Supported:

Expected behavior For HTTPSInfo to show all the available Cipher suites for the URL

Screenshots

Software versions

ZAP: ZAPD_2021-11-08
Add-on: HTTPSInfo Alpha 13.0.0
OS: Windows 10
Java: java -version openjdk version “11.0.12” 2021-07-20 LTS OpenJDK Runtime Environment (build 11.0.12+7-LTS) OpenJDK 64-Bit Server VM (build 11.0.12+7-LTS, mixed mode)
Browser: Chrome Version 95.0.4638.69 (Official Build) (64-bit)

Errors from the zap.log file log_httpsinfo.log

Additional context From the log it looks like DeepViolet is the source of the issue. I also see that DeepViolet no longer has a maintainer. A shame, as Weak TLS is a compliance issue that should really be a part of the alerts. Using nmap --script ssl-enum-ciphers or an external parties tool outside the network can cause problems and is frowned upon when scanning internally.

https://github.com/spoofzu/DeepViolet

Would you like to help fix this issue? Happy to provide detailed bug reports and test fixes.

Issue Analytics

State:
Created 2 years ago
Comments:25 (19 by maintainers)

Top GitHub Comments

2reactions

kingthorincommented, Nov 10, 2021

Sure, I’ll post something.

1reaction

thc202commented, Nov 19, 2021

It could still be maintained as a 3rd party add-on(s).

Top Results From Across the Web

Debugging TLS – an easier way - ColinPaice

Once I had TLS to LDAP working, I used GSK_TRACE=0x04 to trace just errors. Some “errors” are recorded in the GSKTRACE as “INFO”....

Debugging SSL/TLS connections - Oracle Help Center

Understanding SSL/TLS connection problems can sometimes be difficult, especially when it is not clear what messages are actually being sent and received.

Low-Level TLS Debugging | Ping Identity Documentation

Low-Level TLS Debugging If you must resort to low-level debugging options, we recommend that you enable the JVM's support for TLS debugging.

TLS Debug - OWASP ZAP

Documentation · The OWASP ZAP Desktop User Guide · Add-ons · TLS Debug. This add-on has been retired and is no longer available....

Cisco IOS Debug Command Reference - Cisco

debug sntp adjust through debug tag-switching xtagatm vc. ... 23:23:13.988: code_sign_parse_key_record: Tag (Key Info Length:(0x3) found at ...