Mastering Kali Linux for Web Penetration Testing

POODLE – all bark, no bite (usually)

Padding Oracle On Downgraded Legacy Encryption (POODLE) (CVE-2014-3566) is a vulnerability that allows a man-in-the-middle exploit by taking advantage of a downward negotiation of the cipher to the affected SSLv3.0 Cipher Block Chaining (CBC) cipher suites. Using a MITM attack, POODLE requires 256 SSL requests to reveal each byte of data, and it is not used often unless a large-scale, powerful, and persistent MITM proxy is in place for a period of time. Nonetheless, it is a hot button issue, and you can infer that this may exist on a host if SSLscan or SSLyze show that this combination exists, or you can opt to run nmap with its ssl-poodle module to verify that the conditions exist. The following script ...