SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)
3
votes
2answers
52 views
How to fuzz proprietary protocol over SSL?
I'm doing vulnerability research on a client/server architecture that uses a custom proprietary protocol sent over SSL (port 443). I need to be able to intercept the traffic, and be able to view it in ...
-1
votes
0answers
35 views
None of the cipher suites supported by the client application are supported by the server [closed]
I am getting this error in my server's windows event log:
An TLS 1.0 connection request was received from a remote client application, but none of the cipher suites supported by the client ...
2
votes
0answers
46 views
How does Perfect forward secrecy work in https? [duplicate]
How does Perfect forward secrecy work in https?
How to check whether it is enabled or not?
Which big site actually use this? Paypal? Facebook? Amazon?
I have read this Wikipedia article, but I don't ...
2
votes
1answer
79 views
SSL: MITM possible if private key is known? [closed]
If a Man-in-the-middle has the private RSA key of the SSL encryption.
It should be possible for the Man-in-the-middle to decode the entire HTTPS datastream right?
So, then the encryption is ...
1
vote
3answers
97 views
Is it possible to pass TCP handshake with spoofed IP address?
Little time ago, me and my friends argued if TCP handshake can be passed with a spoofed IP address.
Assume I have a https web server that allows only admin's IP numbers.
Can anyone connect that web ...
1
vote
2answers
44 views
User agent information from HTTPS flow
We are categorizing the network traffic , like determining if it is facebook,yahoo etc...
Now I have been asked also seperate mobile devices(like ipad, nexus, iphone).
It is easy to that in HTTP with ...
0
votes
1answer
44 views
Dangers of client & server package, communication over HTTPS using user's own self-signed certificate?
I want to create a client & server package with the option of an encrypted connection.
From my limited understanding, to get HTTPS connections working, the user needs their own certificate ...
3
votes
2answers
60 views
Certificate Chain checking
I have a very specific question.
A client verifies a sever by taking the certificate and checking specific values and that the digital signature of the intermediate CA is correct (According to the ...
2
votes
3answers
128 views
When to use SSL ? / When to send passwords via mail?
Self-Proclaimed Experts are quick to say that for every time a password is being transmitted from a webserver to a user and vv, you need to use SSL. Because there will be people each time trying to ...
4
votes
2answers
148 views
Chrome does not show green bar with EV SSL but firefox and IE does
I just installed a EV SSL certificate on my server. It has been done correctly and is working, the issue is that Chrome does not show the company name in the green address bar, just shows the green ...
3
votes
2answers
127 views
Is it possible to create a secure chat web application relying on HTML5 web sockets?
Is it possible to create a secure chat web application using just HTML5 and Javascript?
What possible security holes would there be if the server doesn't store the messages, just relay them using ...
0
votes
1answer
29 views
how to make socat ignore client certificate?
I'm trying to set up a listener to check if an application checks the server's certificate (I'm strongly assuming it is not). So I've created a self-signed certificate fake.pem for a listener and am ...
-1
votes
3answers
221 views
How likely/possible is it that the NSA have broken common encryption techniques such as SSL/TLS?
Jumping on the NSA/Prism questions bandwagon - There's been a lot more attention drawn to facilities such as Room 641A which indicate that the NSA has been, amongst other things, applying mass ...
0
votes
0answers
55 views
SSL vs TLS, which is less vulnerable to DOS attacks?
When I learned TLS does not allow a connection to be created until it is has finished a secure handshake, i figured that would make it better for preventing DoS attacks.
However, all I seem to find ...
2
votes
1answer
85 views
Is there a Skype plugin that uses TLS and ZRTP
I'm curious, if one can upgrade the security Skype offers to avoid a man in the middle snooping in on the calls by both parties using a client side plugin? Does one exist for this purpose?
A bit of ...
1
vote
1answer
64 views
What is the difference between an HTTPS traffic setup with Stunnel and a SSL-VPN
We have a scenario where we cannot connect to our stunnel server running on port 443 on our network, which only allows access to Internet via a proxy server. On the contrary, when we tried a SSL VPN ...
3
votes
1answer
86 views
MITM and replay attacks prevention
I have a client (a mobile app) and a server, the app connects to the server via SSL.
The server uses a self-signed certificate, and the client has a file (I'm not entirely sure what, something to do ...
9
votes
3answers
171 views
Multi-tenancy, SSL Certificates, and Subject Alternative Name
The X509 specification allows a CA to issue a single certificate for multiple hostnames, by using the "Subject Alternative Name" extension.
From the spec:
The subject alternative name ...
1
vote
1answer
66 views
How to MiTM insert an iframe using burp or another tool?
So, I am trying to obtain a cookie without the secure flag enabled over HTTPS.
After reading about it, I came across an answer:
You visit https://secure.example.com/ which drops a cookie on
your ...
0
votes
1answer
58 views
Is it possible to force a new SSL session
Using tools like Wireshark, it's possible to decrypt SSL traffic as the client by logging the (pre)master secret, without using a mitm attack or the server's private key. But I found that for some ...
1
vote
1answer
54 views
Secure authentication cookie for web site
Hello i want to know if this auth token is secure enough for a site of millions of logged in users:
...
3
votes
1answer
74 views
Is “Fingerprint Check” enough to verify HTTPS certificates?
So I'm at place A, see this sign:
and I'm writing the fingerprints to a piece of paper (this website is just an example):
Ok. Then, I go to place B (other country, etc.) then I check this ...
-2
votes
0answers
24 views
TLS MITM attack at Handshake [duplicate]
I have informed myself about TLS connection and Man in the Middle attacks.
It is easy to hijack anything if the victim is using HTTP. But I'm even concerned about HTTPS / TLS connection. Applications ...
9
votes
3answers
137 views
What simple security considerations can I / should I make for a read-only API?
Right now I'm setting up an API, to be consumed on the client-side to set up a directory site. I'm wondering what extra steps I need to take just to prevent people from gaining write access to the ...
4
votes
1answer
105 views
Why do we allow SSL certificates to be replaced before their expiry date, without revokation of others?
Imagine a situation where a rogue CA creates a certificate for your site. Since the user's browser trusts the CA, it will accept the certificate without any fuss. However, the site's real certificate ...
2
votes
1answer
54 views
Remote network security option
I'm a bit confused with some different network security techniques.
Say we want a secure communication with a particular mail server in a remote company network. Reading and sending mails should be ...
6
votes
3answers
188 views
Security implications of an exploited router
So I completely understand that routers and local networks need to be kept locked down, etc. What real security threats can come about from an attacker who has remotely accessed (telnet or web gui) ...
1
vote
3answers
214 views
Can attackers steal SSL certificate from server and use it for MITM attacks?
I'm writing an iOS app for private use to acts as a client for a PHP server. To secure the connection I'm using a self-signed SSL certificate.
Since the server is self-hosted, on the first connection ...
4
votes
1answer
157 views
TOR detection in network
After I read this link, I tried to understand how they manage detect TOR traffic
The most understandable source for me was this paper
He is saying TOR trafic can be detected by port, cipher suite ...
3
votes
2answers
54 views
Change 'Key Usage' of a certificate
Is it possible to change the 'Key Usage' property of an existing ssl certificate of a web site? Our goal is to host a web service so that a third party can integrate with our solution, and their ...
5
votes
5answers
175 views
How secure is using CRAM-MD5 for email authentication, when not using an SSL connection?
Background: My current server-provider tells me it's no problem to store the passwords in plain-text in the database, saying he has to do so because they use CRAM-MD5 for email authentication. My ...
1
vote
2answers
79 views
Force SSL/TLS client cert authentication even if server does not request it?
Usually the server specifies in the Server Hello message if a client certificate is needed/wanted.
Does anybody know if it is possible to perform an authentication via client cert if the server does ...
2
votes
1answer
57 views
Use Client Certificate using Self Signed CA while using Web Certificate of a publicly trusted CA
I would like to ask if it is possible to use different CA for the client certificate and the web certificate?
For example, I would use Verisign to sign my web certificate while I use my Self Sign ...
-1
votes
1answer
100 views
Wireshark Decode HTTPS Root Certificate
I'm currently dealing with a "Sniffy" java application. Well I can see it connecting to some kind of server using HTTPS. I would like to see what its sending or getting over HTTPS. i have read some ...
7
votes
4answers
1k views
What kind of attack was this?
So our website was hacked, and these are the things that were done:
Some entries in the database were changed. I don't know if this was via SQL injection, or direct database access (only root is ...
4
votes
2answers
128 views
Multiple SSL connections in a single HTTPS web request
I set up Apache2 with SSL and tried to request the default Apache2 web page ("It works!") using https://[IP_ADDRESS].
The Chrome developer tool shows that only one HTTP connection is established, ...
4
votes
1answer
204 views
Decrypting TLS in Wireshark when using DHE_RSA ciphersuites
How can I decrypt TLS messages when an ephemeral Diffie-Hellman ciphersuite is used? I am able to expose the premaster secret and master secret from the SSL Client. Using that, how to decrypt the ...
0
votes
1answer
28 views
What is the difference between SSL and X.509 Certificates?
I used openssl to create a X.509 certificate but I don't quite understand the relationship between a X.509 and a SSL certificate. Are they the same? Is a SSL certificate just a X.509 certificate that ...
3
votes
1answer
56 views
How is the TLS protected against length field of the header being modified?
I know this question looks very silly, but, it has been bothering me for a while and I am unable to come up with an answer by myself. So, here it goes..
Packets in the TLS protocol consist of a 5 ...
5
votes
3answers
94 views
What are the risks of a localhost signed cerificate?
In our company we have an internal CA certificate for signing various things including the proxied (MITM'd) HTTPS connections.
Suppose we use this CA to sign a key for "localhost" for use in ...
6
votes
1answer
225 views
Does HTTPS Encrypt PHP Arguments?
I am working on a web app that will need to have a secret key(s) passed from one server to another - I'll need to do this over PHP. Consider the following URL:
...
1
vote
1answer
75 views
SSL Communication and Proxy
Let us say that I have a client and a server communicating using SSL.
If a hacker sets up a proxy between the client and the server, will he be able to decrypt the data which is being sent?
9
votes
1answer
216 views
Configure SSL Mutual (Two-way) Authentication
A lot of tutorials, a lot of pages, a lot of question and they differ in implementation of this issue "Configure SSL Mutual (Two-way) Authentication". I have to do it with Linux, and I don't know from ...
3
votes
1answer
113 views
Why clients offer handshaking with SSL 2.0 protocol
According to the book, Data Center Fundamentals, page 369, SSLv3 support was added in Netscape 2.x and Internet Explorer 3.x, and TLS was added in Netscape 4.x and Internet Explorer 4.x.
I am ...
4
votes
1answer
158 views
If SSL encrypts urls, then how are https messages routed?
I've googled around and it seems like SSL encrypts URLs. (Correct?) As I understand it, if I go to a site like http://security.stackexchange.com then a DNS server looks at the URL, says hey, he wants ...
4
votes
2answers
138 views
Checking client hello for https classification
I need to detect https packets in network traffic . Until now I were marking all "443" as https but I don't want to use port information for these any more .
Will it be enough to check client hello ...
3
votes
1answer
98 views
Has a HTTP server access to SSL session ID?
I want to know if a HTTP server (Apache, nginx etc.) can access a SSL/TLS session ID. Assume we have some hardware which does only SSL/TLS and behind a webserver which sends and receives the requests. ...
1
vote
2answers
95 views
Question about HTTPS [duplicate]
I have a question about HTTPS, which I need help understanding.
So if I type: https://www.facebook.com/FOOBAR and as the connection is encrypted, will someone in the middle (say my ISP or someone who ...
0
votes
1answer
67 views
Best practice for securing user credentials once they reach the server using Basic Auth + SSL
I know it's generally said that storing user credentials in plaintext is a horrible idea. I'm in the middle of implementing Basic Auth over SSL and was wondering what I should do with the user ...
4
votes
3answers
108 views
What SSL options should not be used?
What SSL options should be avoided, due to recently discovered weaknesses? This might include symmetric algorithms, or MAC functions.
