Hands-On Red Team Tactics

reverse_https with a custom SSL certificate

This technique can be used in two ways:

• By getting an SSL certificate signed by CA (a genuine SSL certificate)
• By using someone else's SSL certificate (impersonation)

You can purchase a genuine SSL certificate from an authorized seller or you can use services such as Let's Encrypt to get a genuine SSL certificate for free. Otherwise, you can always impersonate someone else's SSL certificate. Metasploit really can help us with impersonation. There's a module in Metasploit that can do this for us. Execute the following command in order to use the impersonation module:

Use auxiliary/gather/impersonate_ssl

Set up the following options for SSL certificate impersonation:

set ADD_CN *.packtpub.com set ...