Don’t trust all SSL / TLS certificates

Earlier I did a story about CSR checkers from CA’s and their resellers. This was a nice thing to do and an eye opener for some people. I went for the certificate checkers no! I generated my own CA and self-signed certificate and checked some websites with it.

In my FakeCA root certificate and the leaf certificate on it, I set some XSS information. A simple JavaScript alert. You easily can do this with OpenSSL for example. So I setup my test site and went testing. It wasn’t very difficult to find my first vulnerable website.

Knipsel10

Read more

XSS in a certificate signing request

Web application developers will all know, never to trust the input of the users of the web application. But what if you do not really know what they are submitting?

While investigating some form fields in our application, I came across a form for checking a certificate signing request (CSR) which you need to order a SSL / TLS certificate.

A certificate signing request is an encoded file with the information to request a certificate from a certificate authority (CA) or a reseller of that CA. You will need to create that file yourself and put in the information that you want.

Read more