https://github.com/osquery/osquery logo
Title
t

Taj Popoola

06/08/2020, 3:21 PM
W0608 09:33:20.691399 19904 tls_enroll.cpp:76] Failed enrollment request to https://<ip address>:8080/osquery/enroll (Cannot parse JSON: Invalid value. Offset: 0) retrying.
z

zwass

06/08/2020, 3:43 PM
Looks like the server is not returning JSON. Probably because you have the path wrong?
/api/v1/osquery/enroll
.
--tls_dump --verbose
with osquery will help you see what the communications look like.
t

Taj Popoola

06/09/2020, 3:25 PM
Thanks @zwass, tried modifying the info in the flags file but still getting same error. Here is the flags file attached: I did use the -tls_dump --verbose and here is more of the info presented
<script>document.addEventListener("touchstart", function() {},false);</script> </body> </html> W0608 09:33:08.768553 19904 tls_enroll.cpp:76] Failed enrollment request to https://m0508513.lab.ppops.net:8080/osquery/enroll (Cannot parse JSON: Invalid value. Offset: 0) retrying... Thrift: Mon Jun 8 09:33:10 2020 Client connected. Thrift: Mon Jun 8 09:33:10 2020 TPipe ::GetOverlappedResult errored GLE=errno = 109 Thrift: Mon Jun 8 09:33:10 2020 Client connected. Thrift: Mon Jun 8 09:33:10 2020 TConnectedClient died: TPipe: GetOverlappedResult failed Thrift: Mon Jun 8 09:33:10 2020 TPipe ::GetOverlappedResult errored GLE=errno = 109 Thrift: Mon Jun 8 09:33:10 2020 TConnectedClient died: TPipe: GetOverlappedResult failed I0608 09:33:11.581754 19904 tls.cpp:253] TLS/HTTPS POST request to URI: <ip address>:8080/osquery/enroll
z

zwass

06/09/2020, 4:43 PM
The logs show you are still hitting the wrong endpoint.