Hack Tool Repository Logo

Hack Tool Repository

white curve white curve

Article: TLS & SSLv3 renegotiation vulnerability

Google
 

This paper describes how to test for the TLS & SSLv3 renegotiation vulnerability:

The toolset provided by Openssl offers the simplest way to test whether a server allows for client-side renegotiation in the established tunnel.

Note: This doesn't necessarily mean that the application beneath is vulnerable to attacks over this channel, but indicates the server allows attacks to happen.


Generic Example
Openssl s_client -connect yourserver.com:443
R (Triggers renegotiation - if this works, the server accepts renegotiations within an existing TLS session Requirement)
GET /clientcontrolled.html http\1.0


Hits: 399
Added: 2009-11-28 12:30:19
Updated: 2009-11-29 11:25:33
 
Olderchurch Web Site About Us | Site Map | Contact Us | ©2007 Olderchurch Security Consultancy