Collaborate Disseminate
I tried to search online for the difference between both CSR certificate and a certificate but I couldn’t find a concrete asnwer.
I am doing my own lab using this tutorial https://www.golinuxcloud.com/openssl-create-certificate-chain-linux… Continue reading what is the difference between the root CA certificate and the intermediate CSR certificate
I was testing the supported cipher suites for an exposed httpd service.
On the server, the cipher suites are defined in the httpd properties file ( httpd.sslCipherSuite=….)
When I run testssl from my Kali machine, I get a list of cipher … Continue reading testssl not detecting all cipher suites
I am trying to analyze whether I am exploitable to the new CVE in spring security.
As per Spring they mention the following:
Specifically, an application is vulnerable when any of the following is true:
You are using the SecurityContextHo… Continue reading Am I exploitable to CVE-2023-20862?
We have 2 servers communicating, server A (a server that I own), and server B (server on the internet that I trust). I get some info from server B, which are FIX messages (https://en.wikipedia.org/wiki/Financial_Information_eXchange).
Serv… Continue reading Using FIX over TLS, is there a need to sign FIX mesages?
I have 2 endpoints that are exchanging data (FIX messages), and the originating endpoint is genrating the fix files are sending them on an ecrypted channel (TLS or Stunnel). In a security audit, it was recommended that the files are signed… Continue reading are files sent in a TLS channel signed? [duplicate]
I ran testssl.sh on a server and can see that it is vulenrable to logjam.
Now I am interested in doing a PoC to validate the server is exploitable to this vulenrability.
I searched through google but most articles explain the vulnerability… Continue reading How to PoC the CVE-2015-4000 logjam vulnerability
I am trying to find POC for this CVE, but I couldn’t. Where can I find a poc for this cve? and why most of CVEs don’t list its poc, its very important to include a poc to understand the vulnerability.
Please if there is a good resource fo… Continue reading POC for CVE-2017-7657
I am analyzing CVE-2022-0839.
When checking the commit, I don’t understand why the commit is on a test class. I mean, how does a test class fix a vulnerable component? shouldn’t the fix be done in the guilty class?
Continue reading Why is the fix for CVE-2022-0839 on a test class?
When I’m trying to analyze CVEs to detect which jars are affected by the CVE, I getting confused.
Let’s take as an example this CVE: CVE-2022-22978
In the description:
"In Spring Security versions 5.5.6 and 5.6.3 and older unsupporte… Continue reading how to know CVE affects which Jar/artifact?
Context
A JAVA thick client that communicates with a server: the communication is using JAVA RMI but encrypted, so it’s RMI over TLS, in part of the code TLS versions 1 and 1.1 are removed.
Question
Where are the default TLS versions and t… Continue reading Where is the default TLS configuration implemented? [closed]