Re: Evading Client-Certificate Authentication

From: Imre Kertesz (ikertesz_at_fastq.com)
Date: 04/01/04

  • Next message: Kevin Vanhaelen: "Evading Client-Certificate Authentication" 
    Date: Wed, 31 Mar 2004 16:58:43 -0700
To: pen-test@securityfocus.com, webappsec@securityfocus.com

    Im not one to argue semantics, but "stumbling" upon a web server during
    a "sanctioned" penetration test doesn't happen unless the penetration
    test is blind .. or the customer forgot to set you up with a client
    certificate .. or the web server that you stumbled upon isn't within the
    scope of your sanctioned assessment. In all cases but the latter, the
    customer needs to generate a client certificate for you. They are
    probably running their own CA, which you may need to visit to generate a
    certificate request. The trick is to get a certificate that is
    EXPORTABLE so that you can fux0r it with openssl into PEM format that
    stunnel can use and viola - instant client certificate proxy. Once you
    have this client certificate / stunnel proxy, you might have to do some
    local DNS foo to make sure that the application recognizes your stunnel
    host as a legitimate target, but it should work fine.

    -I

    Kevin Vanhaelen wrote:

    >Hi to all,
    >
    >whilst in the middle of a Penetration Test I stumbled on a web server only
    >serving SSL and demanding the client to present
    >a certificate to identify himself.
    >I tried to nikto it with sslproxy and browse the site thru paros both with a
    >temporary Verisign personal certificate.
    >No such luck, the server keeps bouncing me off. Even vulnerability scanners
    >like Nessus and Retina don't get passed
    >the port-scan portion.
    >
    >Does anyone have an idea to further assess this server? Am I looking at a
    >mission impossible here maybe?
    >
    >Thanks,
    >
    >~kevin
    >
    >
    >
    > 

    -- 
-· · ···- · ·-· ·--· · - ·- -··· ··- ·-· -· ·· -· --· -·· --- --·
"If you sit quietly at the edge of a river, eventually
you will see the bodies of your enemies float by" 
-A maxim of patience, author unknown
Imre Kertesz
PGP ID: 	0xA5DD6F44
---------------------------------------------------------------------------
You're a pen tester, but is google.com still your R&D team?
Now you can get trustworthy commercial-grade exploits and the latest
techniques from a world-class research group.
www.coresecurity.com/promos/sf_ept1
----------------------------------------------------------------------------
  • Next message: Kevin Vanhaelen: "Evading Client-Certificate Authentication"

    Relevant Pages

    • Re: IIS 6 behavior on checking clients certificates (again)
      ... >> against the Web server certificate as the certfile. ... >> Do the same test at the Web server against the client certificate as the ... > certificate I saw that almost everything is Ok excepting expired Delta CRL ...
      (microsoft.public.windows.server.security)
    • Re: Client Certificate User Mapping
      ... As the article you included stated: For Active Directory Service Mapping of ... Certificates the web server has to be member of the domain. ... Configure Client Certificate Mappings in Internet ...
      (microsoft.public.inetserver.iis)
    • Client Certificate
      ... I am building a HTTPS web application for our own staff to access the ... company's web server through the Internet. ... The web server is installed with a server certificate, ... HTTP header of a valid client certificate. ...
      (microsoft.public.win2000.security)
    • Re: Issues with SSL on Win CE 5.0
      ... the HKCU certificate store. ... and tell the web server to use it. ... The old cert was in. ...
      (microsoft.public.windowsce.embedded)
    • Re: Issues with SSL on Win CE 5.0
      ... the HKCU certificate store. ... and tell the web server to use it. ... The old cert was in. ...
      (microsoft.public.windowsce.embedded)