cert-pinning-flaw-poc

证书固定漏洞 POC 用于测试 CVE-2016-2402 及类似漏洞的简单 POC 脚本。详细内容请阅读我的博客文章。 此工具将设置一个 HTTPS 服务器，为特定域名的客户端提供恶意证书链。 如果来自具有漏洞证书固定实现的应用程序的流量被重定向到此服务器，则固定机制将被绕过，并且您应该能够在服务器控制台中看到 GET 或 POST 请求。 默认情况下，此工具使用硬编码的 CA 证书和密钥（CACERT.pem 和 CAKEY.pem 文件）。 您可以更改这些文件，使用以下命令生成新的证书对。 openssl req -x509 -days 1825 -nodes -newkey...

certPinningVulnerableOkHttp

Aplicación simple-client de OkHttp vulnerable a CVE-2016-2402 Esto es un fork del simple-client por defecto del proyecto okhttp. Simple-client es una aplicación Java que simplemente hace una petición GET a https://api.github.com y obtiene los nombres de los contribuidores de okhttp. Este fork ha...

Security Bulletin: IBM Cloud Pak for Security includes components with multiple known vulnerabilities

Summary IBM Cloud Pak for Security includes components with known vulnerabilities. These have been updated in the latest release and vulnerabilities have been addressed. Please follow the instructions in the Remediation/Fixes section below to update to the latest version of Cloud Pak for Security...

OkHttp Certificate Pinning Vulnerability CVE-2016-2402

h3. Issue Summary Portfolio uses Okhttp 2.2.0 which has an identified vulnerability: https://nvd.nist.gov/vuln/detail/CVE-2016-2402 https://www.securityfocus.com/bid/83296/info https://publicobject.com/2016/02/11/okhttp-certificate-pinning-vulnerability/ h3. Steps to Reproduce...

OkHttp Certificate Pinning Vulnerability CVE-2016-2402

h3. Issue Summary Portfolio uses Okhttp 2.2.0 which has an identified vulnerability: https://nvd.nist.gov/vuln/detail/CVE-2016-2402 https://www.securityfocus.com/bid/83296/info https://publicobject.com/2016/02/11/okhttp-certificate-pinning-vulnerability/ h3. Steps to Reproduce...

CVE-2016-2402

OkHttp before 2.7.4 and 3.x before 3.1.2 allows man-in-the-middle attackers to bypass certificate pinning by sending a certificate chain with a certificate from a non-pinned trusted CA and the pinned certificate...

CVE-2016-2402

OkHttp before 2.7.4 and 3.x before 3.1.2 allows man-in-the-middle attackers to bypass certificate pinning by sending a certificate chain with a certificate from a non-pinned trusted CA and the pinned certificate...

CVE-2016-2402

CVE-2016-2402 affects OkHttp, where MITM bypass of certificate pinning is possible. The vulnerability occurs when an attacker presents a certificate chain containing a non-pinned trusted CA alongside the pinned certificate, enabling bypass of pinning checks in OkHttp before 2.7.4 and in 3.x befor...