Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security FullDisclosure
[Top] [All Lists]
<prev [Date] next>
[Advanced]
 <prev [Thread] next>

Re: [Full-disclosure] Webwasher SSL scanner

from [coderman] Network Security [Permanent Link]
Subject: Re: [Full-disclosure] Webwasher SSL scanner
Date: Mon, 24 Dec 2007 18:09:03 -0800 
On Dec 24, 2007 3:53 PM, coderman <coderman@gmail.com> wrote:

i am looking for details of the PKI for integration of webwasher ssl
scanner into an organization.


thanks to those who responded.  in the interest of propagating useful
information:

the structure of PKI implemented in an organization is external to the
device.  you load a CA key (can be a root or not) into the device and
ensure that all clients have that CA cert as trusted.  the device can
then MitM to any site on demand (but may restrict to approved sites
only).

grab a cert from this unit, and you can MitM yourself all day long.

interestingly enough, i am certain this does not support client side
certs.  (for example, we use VeriSign client certs for mutual
authentication in some situations.  this would be broken behind an SSL
scanner.)

best regards, happy holidays,

:)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
[More messages with this same subject...]




<Prev in Thread] Current Thread [Next in Thread>
Previous by Date:  [Full-disclosure] Webwasher SSL scanner, coderman
Next by Date:  [Full-disclosure] Ho Ho H0-Day - ZyXEL P-330W multiple XSS and XSRF vulnerabilities, Santa Clause
Previous by Thread:  [Full-disclosure] Webwasher SSL scanner, coderman
Next by Thread:  [Full-disclosure] Ho Ho H0-Day - ZyXEL P-330W multiple XSS and XSRF vulnerabilities, Santa Clause
Indexes:  [Date] [Thread] [Top] [All Lists]