You might have noticed the SSL/TLS authentication gap vulnerability that was announced publicly in November. If not, you can find the original whitepaper at phonefactor.com. Thierry Zoller also published a detailed analysis and description of the problem.
Like many others, we have spent some time on that vulnerability. Unfortunately, the original Proof-of-Concept code is written in C and cumbersome to use. So Lutz decided to write our own. This PoC is written in Python and is – hopefully – platform independent. It works great for doing Man-in-the-Middle attacks against HTTPS-secured websites. We already used the code in our pentests and demonstrated to our clients what may happen if SSL/TLS renegotiation is enabled.
We are going to release the code in a couple of days on our website, so stay tuned and check the news and this blog for updates.
{ 1 } Comments
Cool, I am eager to test it in a VoIP environment ;-)
Inform me when it will published…
Health & Happiness :-D
Sn0rkY
{ 2 } Trackbacks
[...] As promised, the TLS Renegotiation vulnerability Python PoC is now publicly available on our websites: [...]
[...] SSL Man-in-the-Middle PoC to come – blogs.23.nu/RedTeam Red Team to release a SSL/TLS authentication man-in-the-middle attack [...]
Post a Comment