JA3 hash error on latest build

vladzz

Hi,

The latest build is giving this error with the ja3hash plugin. It was working previously

Sat Jun 23 12:29:58 2018.011769 ERROR [jahash.lua][LSB-BaseDiscoverCap] Unable to load lua file, see next message
Sat Jun 23 12:29:58 2018.011785 ERROR [jahash.lua]LUA file error : ...nfig/lua//github.com_trisulnsm_apps/tls-print/jahash.lua:13: libcrypto.so.1.0.0: cannot open shared object file: No such file or directory
Sat Jun 23 12:29:58 2018.022096 ERROR [jahash.lua][LSB-BaseDiscoverCap] Unable to load lua file, see next message
Sat Jun 23 12:29:58 2018.022112 ERROR [jahash.lua]LUA file error : ...nfig/lua//github.com_trisulnsm_apps/tls-print/jahash.lua:13: libcrypto.so.1.0.0: cannot open shared object file: No such file or directory
Sat Jun 23 12:29:58 2018.248819 ERROR [jahash.lua][LSB-BaseDiscoverCap] Unable to load lua file, see next message
Sat Jun 23 12:29:58 2018.248835 ERROR [jahash.lua]LUA file error : ...nfig/lua//github.com_trisulnsm_apps/tls-print/jahash.lua:13: libcrypto.so.1.0.0: cannot open shared object file: No such file or directory

Running on CentOS 7.4

Thanks,
Vladimir

vladzz

Thanks the latest app update for TLS Fingerprint fixed that. Now getting another set of warnings in log

seeing log

trisul_probe:unpl-16-PROBE2A(domain0)> 
trisul_probe:unpl-16-PROBE2A(domain0)> 
trisul_probe:unpl-16-PROBE2A(domain0)> log default@probe2A log=ns tail

Wed Jul  4 07:29:34 2018.413300 ERROR lua_pcall [jahash.lua]  Error c=NA f=/usr/local/var/lib/trisul-probe/domain0/probe0/context0/config/lua//github.com_trisulnsm_apps/tls-print/jahash.lua
Wed Jul  4 07:29:34 2018.413348 ERROR lua_pcall [jahash.lua] lua Error:...ig/lua//github.com_trisulnsm_apps/tls-print/sweepbuf.lua:147: attempt to perform arithmetic on a nil value
Wed Jul  4 07:29:34 2018.413845 ERROR lua_pcall [jahash.lua]  Error c=NA f=/usr/local/var/lib/trisul-probe/domain0/probe0/context0/config/lua//github.com_trisulnsm_apps/tls-print/jahash.lua

harmless?

admin

Hi,

It is a harmless error, fixed in new app. Go to Admin > Apps > TLS Fingerprint > Update. Should go away.

Thanks,