Collaborate Disseminate
Detection of outdated TLS/SSL protocols are one of the most common findings I have seen in many vulnerability scans and penetration testing reports. It is reported as a serious vulnerability too. Every time I see this, I wonder how easy or… Continue reading How easy or difficult it is to exploit older SSL/TLS protocols?
According to the OWASP Cheat Sheet on Certificate Pinning, their recommendation is to pin to the leaf certificate, but also pin to the intermediate CA as a backup.
Any security measure is only as good as its weakest link, so in this case i… Continue reading Benefits of certificate pinning to leaf with intermediate as a backup?
In my case: I have an old dedicated PC which I have named "server". The ISP gives it a full dynamic IP and is very hard to update dynamic DNS constantly with my records.
The (free) certificates ask for a hostname or a fixed IP. S… Continue reading What is the problem in manually implementing the SSL handshake at app layer? [closed]
I was running MQTT broker in my pc and tried to connect to it via mqtt client in same PC. using x509 cert for mutual tls. SSL Handshake was failing with RST from server. This was happening only in my PC.
When I tried to do the same setup i… Continue reading SSL handshake failure | Client hello(success) -> Server ACK (success) -> server RST (connection closed)
I received a spam text message and interrogated the domain name:
$ openssl s_client -servername https://example.com -connect example.com:443
What I want to know, is how likely it is that I should see the following
write:errno=0
no peer c… Continue reading TLS1.3 using no cipher?
I would like to know the process of how public keys/certificates are renewed for a website. I understand the concept of CA (Certificate Authority) chains, and how the public key/certificate for a site is signed by a CA (usually an intermed… Continue reading SSL/x509 certificate/public key expiration [duplicate]
I’ve heard second-hand that the TLS 1.3 spec includes additional functionality to avoid URL category list filtering by firewalls and cloud-based proxies. Is that correct? If so, is there any documentation on how that works?
I can’t seem … Continue reading Does TLS 1.3 spec include additional privacy controls for avoiding URL category filtering?
I tried to capture the send-out traffic of the Android app (Google Drive, Facebook, etc.). This is my security thesis.
I succeed capture send-out traffic on the Google Drive app with Mitmproxy but with Facebook and Messenger, I can’t.
I ha… Continue reading SSL issue captures Facebook app send out traffic
Currently I’m working with mitmproxy and intercepting some HTTPs traffic using it. Before I could use it in my browser, I had to trust the certificate via my OS settings. After that, the certificate was trusted by my machine and browser di… Continue reading Misuse of trusted certificate authority [duplicate]
What version of TLS would be required for a router that separates client requests from a web server behind a router?
Let’s say the supported TLS client is 1.2 and so is the web server, BUT the router doesn’t support TLS 1.2, it’s only 1.0…. Continue reading Web request TLS