5 ms·

To second the discussion everyone has about utilizing netcat instead I also want to point out that there is a tool on pretty much every linux machine ever that

To second the discussion everyone has about utilizing netcat instead I also want to point out that there is a tool on pretty much every linux machine ever that can perform netcat for SSL: `openssl s_client`. Ive used it on multiple occasions for toying with the HTTPS protocol and all of the features that only enable themselves when using a secure connection. It does just what netcat does, but initiates a secure SSL tunnel first.

tedunangst 3y ago
You can't send a line containing only (make that beginning with) the letter R with s_client because that does a renegotiation.
- codetrotter 3y ago
  That’s pretty interesting but also, how often do you find yourself needing to send a single capital “R” in practice? I mean, I assume at least once since you know about it. But for me, I don’t think I’ve ever typed a singular capital R anywhere on purpose.
  - tedunangst 3y ago
    It's actually any line starting with R, like Referrer: yahoo.com. Also any line starting with Q, like Quiet, will disconnect, because you obviously meant Quit.
    - codetrotter 3y ago
      Oof :/
- jandrese 3y ago
  Try the -nocommands option to disable that bit of braindamage.
- juped 3y ago
  if only someone were to add tls support to nc(1) or something
  - koolba 3y ago
    You can use socat. It’s like nc on steroids. TLS, Unix sockets, and just about anything else that involves a digital cable connecting two streams of data. When in doubt, just add more forking and socat!
  - somat 3y ago
    Openbsd nc supports tls, note the -c option http://man.openbsd.org/nc http://man.openbsd.org/nc
    - JdeBP 3y ago
      This thread includes Ted Unangst and juped. They already know.
chasil 3y ago
The s_client binary does not implement all of the terminal controls in real telnet. If you really want to use true telnet over TLS on the registered port of 992, then get a regular telnet client and telnet to a custom port on local host. On that custom port, run stunnel in client mode. You can run this either in an inetd/socket activation setup, or in daemon mode that actively calls listen() That stunnel should be configured to point at your telnet-ssl server (on port 992 if you want it accurately fingerprinted). That telnet-ssl server should also be stunnel, and it should be configured to run telnetd in inetd mode. That is the correct way to implement telnet-ssl. I would not trust any telnet client or server that was linked directly to a TLS library.
hddqsb 3y ago
**WARNING:** `openssl s_client` is designed only as a diagnostic tool and is NOT suitable if you care even slightly about security. By default it continues on verification failures so you get absolutely zero security. You must specify the options `-verify_return_error -verify_hostname <hostname>` to get even a semblance of security; however I don't know if they are sufficient, and the fact that they are not enabled by default is a massive red flag that tells you this tool was not designed to be secure. As an alternative, I suggest using `gnutls-cli <host>[:<port>]` or `socat - SSL:<host>:<port>` (if they are installed; unfortunately they are not common). They pass the "Certificate" tests on https://badssl.com/ https://badssl.com/ except for "pinning-test".

tedunangst 3y ago

You can't send a line containing only (make that beginning with) the letter R with s_client because that does a renegotiation.

codetrotter 3y ago
That’s pretty interesting but also, how often do you find yourself needing to send a single capital “R” in practice? I mean, I assume at least once since you know about it. But for me, I don’t think I’ve ever typed a singular capital R anywhere on purpose.
- tedunangst 3y ago
  It's actually any line starting with R, like Referrer: yahoo.com. Also any line starting with Q, like Quiet, will disconnect, because you obviously meant Quit.
  - codetrotter 3y ago
    Oof :/
jandrese 3y ago
Try the -nocommands option to disable that bit of braindamage.
juped 3y ago
if only someone were to add tls support to nc(1) or something
- koolba 3y ago
  You can use socat. It’s like nc on steroids. TLS, Unix sockets, and just about anything else that involves a digital cable connecting two streams of data. When in doubt, just add more forking and socat!
- somat 3y ago
  Openbsd nc supports tls, note the -c option http://man.openbsd.org/nc http://man.openbsd.org/nc
  - JdeBP 3y ago
    This thread includes Ted Unangst and juped. They already know.

chasil 3y ago

The s_client binary does not implement all of the terminal controls in real telnet. If you really want to use true telnet over TLS on the registered port of 992, then get a regular telnet client and telnet to a custom port on local host. On that custom port, run stunnel in client mode. You can run this either in an inetd/socket activation setup, or in daemon mode that actively calls listen() That stunnel should be configured to point at your telnet-ssl server (on port 992 if you want it accurately fingerprinted). That telnet-ssl server should also be stunnel, and it should be configured to run telnetd in inetd mode. That is the correct way to implement telnet-ssl. I would not trust any telnet client or server that was linked directly to a TLS library.

hddqsb 3y ago

**WARNING:** `openssl s_client` is designed only as a diagnostic tool and is NOT suitable if you care even slightly about security. By default it continues on verification failures so you get absolutely zero security. You must specify the options `-verify_return_error -verify_hostname <hostname>` to get even a semblance of security; however I don't know if they are sufficient, and the fact that they are not enabled by default is a massive red flag that tells you this tool was not designed to be secure. As an alternative, I suggest using `gnutls-cli <host>[:<port>]` or `socat - SSL:<host>:<port>` (if they are installed; unfortunately they are not common). They pass the "Certificate" tests on https://badssl.com/ https://badssl.com/ except for "pinning-test".