Mastering Kali Linux for Web Penetration Testing

Revisiting the classics

SSL and TLS have both seen their share of vulnerabilities as time has marched on; this is inevitable given the huge dependence on modules such as OpenSSL that are maintained by a small band of overworked and under-supported volunteers. Some of the other vulnerabilities we should understand and check for are described here:

• BEAST: Our customers need to practice good patching and configuration hygiene to avoid attacks such as the Browser Exploit Against SSL/TLS (CVE-2011-3389) attack. BEAST targets TLSv1.0 Initialization Vectors (IVs), which are seed values to help randomize the encryption. Guessing IVs helps attackers reconstruct the conversation and reveal the very plain text that was supposed to be obscured. They ...