RE: MS crypto API based ssl proxy??
From: Gaziel, Avishay (avishaygaziel_at_kpmg.com)
Date: 01/07/04
- Previous message: Shade: "Re: MS crypto API based ssl proxy??"
- Maybe in reply to: Shashank Rai: "MS crypto API based ssl proxy??"
- Next in thread: Brewis, Mark: "RE: MS crypto API based ssl proxy??"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
To: "'shashrai@emirates.net.ae'" <shashrai@emirates.net.ae>, Volker Tanger <volker.tanger@discon.de> Date: Wed, 7 Jan 2004 18:12:46 +0100
I would try getting (or generating using openSSL) a set of client
certificates with popular user/password combinations, or, if you have a list
of users (a corporate phone list would do)I would create a few certificates
for these users as well. openssl/stunnel/sslproxy have all been used for
that.
It's not much but might work.....
A.
-----Original Message-----
From: Shashank Rai [mailto:shashrai@emirates.net.ae]
Sent: 07 January 2004 04:37
To: Volker Tanger
Cc: pen-test@securityfocus.com
Subject: Re: MS crypto API based ssl proxy??
> It maybe uses the Micro$oft NTLM authentication scheme - or similar.
> What does a packet sniffer tell you, what happens?
>
> Bye
>
> Volker Tanger
> ITK-Security
It is nothing to do with NTLM auth (or for that matter basic auth). When
i browse the site using IE, i am prompted to provide the user
certificate. Running stunnel/sslproxy in debug mode clearly show the
server requesting the client certificate.
Packet sniffer is good only to the extent of showing me TLS v1 hand
shake (and ofcourse the remaining conversation is encrypted).
I belive the site is M$ specific, 'coz, sslproxy/stunnel manage to
complete the SSL handshake, and open a connection to the server. But the
moment i send a "GET / HTTP/1.0" request, the connection is closed from
the server end, stating that the client certificate i provided is not
valid (the certificate had been exported from IE, along with the private
key). Hence the conclusion that the calls made to check the validity of
the certificate are someway M$ specific!!! (as stated in my original
post)
Thanks anyway :)
cheers,
--
shashank
<--
Here is the Packet that was fragmented and has been assembled again.
(with apologies to JRR Tolkien :)
-->
---------------------------------------------------------------------------
----------------------------------------------------------------------------
--------------------------------------------------------------------------------------------------------------------------------------------
De informatie verzonden met dit e-mailbericht (en bijlagen) is uitsluitend bestemd voor de geadresseerde(n) en zij die van de geadresseerde(n) toestemming hebben dit bericht te lezen. Gebruik door anderen dan geadresseerde(n) is verboden. De informatie in dit e-mailbericht (en de bijlagen) kan vertrouwelijk van aard zijn en kan binnen het bereik vallen van een geheimhoudingsplicht.
KPMG is niet aansprakelijk voor schade ten gevolge van het gebruik van elektronische middelen van communicatie, daaronder begrepen -maar niet beperkt tot- schade ten gevolge van niet aflevering of vertraging bij de aflevering van elektronische berichten, onderschepping of manipulatie van elektronische berichten door derden of door programmatuur/apparatuur gebruikt voor elektronische communicatie en overbrenging van virussen en andere kwaadaardige programmatuur.
Any information transmitted by means of this e-mail (and any of its attachments) is intended exclusively for the addressee or addressees and for those authorized by the addressee or addressees to read this message. Any use by a party other than the addressee or addressees is prohibited. The information contained in this e-mail (or any of its attachments) may be confidential in nature and fall under a duty of non-disclosure.
KPMG shall not be liable for damages resulting from the use of electronic means of communication, including -but not limited to- damages resulting from failure or delay in delivery of electronic communications, interception or manipulation of electronic communications by third parties or by computer programs used for electronic communications and transmission of viruses and other malicious code.
--------------------------------------------------------------------------------------------------------------------------------------------
---------------------------------------------------------------------------
----------------------------------------------------------------------------
- Previous message: Shade: "Re: MS crypto API based ssl proxy??"
- Maybe in reply to: Shashank Rai: "MS crypto API based ssl proxy??"
- Next in thread: Brewis, Mark: "RE: MS crypto API based ssl proxy??"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
