Terrapin Scanner

Abstract

1. Introduction

This will download, compile, and install the Go package for your local system. The compiled binary will become available at $GOBIN/Terrapin-Scanner. If the GOBIN environment variable is not set, Go will default to using $GOPATH/bin or $HOME/go/bin, depending on whether the $GOPATH environment variable is set.

The Terrapin Vulnerability Scanner is a small utility program written in Go, which can be used to determine the vulnerability of an SSH client or server against the Terrapin Attack. The vulnerability scanner requires a single connection with the peer to gather all supported algorithms. However, it does not perform a fully fledged SSH key exchange, will never attempt authentication on a server, and does not perform the attack in practice. Instead, vulnerability is determined by checking the supported algorithms and support for known countermeasures (strict key exchange). This may falsely claim vulnerability in case the peer supports countermeasures unknown to this tool.

However, we understand that you might prefer building tools that connect to your SSH server yourself. To do this, ensure that you have at least Go v1.18 installed. To compile and install the Terrapin Vulnerability Scanner Go package, run the command below.

2. Objective

This repository contains a simple vulnerability scanner for the Terrapin attack present in the paper "Terrapin Attack: Breaking SSH Channel Integrity By Sequence Number Manipulation".

This project demonstrates how Go can be applied to a real-world Cybersecurity & Ethical Hacking problem.

4. Technology Stack

5. System Requirements

General requirements for this technology stack — check the README for exact versions.

• Go 1.20 or later
• Git (to clone the repository)

6. Installation & Setup

git clone https://github.com/RUB-NDS/Terrapin-Scanner.git
cd Terrapin-Scanner

# Scan the SSH server available at localhost port 2222
./Terrapin-Scanner --connect localhost:2222

# If no port is specified, the tool will default to port 22 instead
./Terrapin-Scanner --connect localhost

# To scan an SSH client, specify the listen command instead
# After running the command, you will need to connect with your SSH client to port 2222
./Terrapin-Scanner --listen 0.0.0.0:2222

# When binding to localhost, you can omit the interface address
# The following command will listen for incoming connections on 127.0.0.1:2222
./Terrapin-Scanner --listen 2222

{
    "RemoteAddr": "127.0.0.1:22",
    "IsServer": true,
    "Banner": "SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.5",
    "SupportsChaCha20": true,
    "SupportsCbcEtm": false,
    "SupportsStrictKex": true,
    "Vulnerable": false
}

Full setup instructions are in the project README.

7. Future Enhancements

Suggested extensions you can add to make this your own project.

• Add logging and alert notifications (email / Telegram)
• Write a threat model document for the tool
• Package it with Docker for safe lab testing

8. Viva / Review Questions

Common questions examiners ask for projects in this domain.

1. Which threat or attack does this project defend against?
2. What detection or protection technique is used and what are its limits?
3. How are false positives and false negatives handled?
4. Which cryptographic algorithms or security standards are involved?
5. What legal and ethical rules apply when testing a tool like this?

9. Source Code & License

This project is developed by RUB-NDS and published on GitHub under the Apache License 2.0. Please follow the license terms and credit the original author when you use or modify this code.