search

RUB-NDS / Terrapin-Scanner

This repository contains a simple vulnerability scanner for the Terrapin attack present in the paper "Terrapin Attack: Breaking SSH Channel Integrity By Sequence Number Manipulation".
https://terrapin-attack.com
Apache License 2.0
931 stars 62 forks source link

Default listener is started at interface 127.0.0.1 #33

Closed PSLLSP closed 4 months ago

PSLLSP commented 5 months ago

When no host is specified in listen mode, scanner is binded to the local interface, 127.0.0.1. Why not 0.0.0.0?

user@ubuntu:~$ ./Terrapin_Scanner_Linux -version
Terrapin Vulnerability Scanner v1.1.3

user@ubuntu:~$ ./Terrapin_Scanner_Linux -listen 34567
Listening for incoming client connection on 127.0.0.1:34567

Workarround (IPv4):

user@ubuntu:~$ ./Terrapin_Scanner_Linux -listen 0.0.0.0:34567
Listening for incoming client connection on 0.0.0.0:34567

Workarround (IPv6):

user@ubuntu:~$ ./Terrapin_Scanner_Linux -listen [0::0]:34567
Listening for incoming client connection on [0::0]:34567
TrueSkrillor commented 4 months ago

The scanner has been designed primarily for local scanning of clients. This means a user fires up the scanner and follows up with the SSH client to test it on the same machine. In this scenario, it is unnecessary and may not be desirable to bind to 0.0.0.0 due to port conflicts or firewall rules. If the scanner is being used over the network, one can specify 0.0.0.0 explicitly as the bind address (as done in your workarounds). So, I do think that the current behavior is more in line with the overall design goals of the scanner, which is why I will keep this behavior for now.