Re: TLS implementation test



hi guys,

when i remove or add data application don't provide any alert, but
transfert is breaked. It'can be a problem, but at least, server is not
compromised.

That"s better than nothing.

Thanks

2006/10/21, Tim <tim-pentest@xxxxxxxxxxxxxxxxxxx>:

> I have to test TLS implementation on our product. Ths goal is not to
> discover a threat in TLS but to find threat in our implementation.
> In my test I'll do :
> - MitM
> - Replay attack (I think it will not be possible because of TLS timestamps )
> - Dos
> - Sniffing (to check that all communications are encrypted)
>
> What other tests could be done ?

Well, there's always modification. If someone adds or removes encrypted
data, or modifies it in transit, will your implementation detect it?
This is particularly important when using stream cipher based
ciphersuites.

Also, does your implementation do perform correct client/server
certificate validation? It's a pretty complex process, and other major
implementations have had bugs in the past in this area.

good luck,
tim


------------------------------------------------------------------------
This List Sponsored by: Cenzic

Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.
http://www.cenzic.com/products_services/download_hailstorm.php?camp=701600000008bOW
------------------------------------------------------------------------



Relevant Pages

  • Re: TLS implementation test
    ... discover a threat in TLS but to find threat in our implementation. ... Replay attack (I think it will not be possible because of TLS timestamps) ... This is particularly important when using stream cipher based ... Cenzic Hailstorm finds vulnerabilities fast. ...
    (Pen-Test)
  • Re: Informing Companies about security vulnerabilities...
    ... Perhaps they are more willing to react if they are forced ... vulnerable website IMHO. ... i don't want to put this threat into a discussion ethical vs. ... Cenzic Hailstorm finds vulnerabilities fast. ...
    (Pen-Test)