Conversation

Notices

1. Embed this notice
   Ryan Castellucci :nonbinary_flag: (ryanc@infosec.exchange)'s status on Saturday, 18-May-2024 18:13:42 JST Ryan Castellucci :nonbinary_flag:

   I put all the xss stuff from the big list of naughty strings into a tls certificate, lets see if anyone notices.

   • Embed this notice
     Ryan Castellucci :nonbinary_flag: (ryanc@infosec.exchange)'s status on Saturday, 18-May-2024 18:20:10 JST Ryan Castellucci :nonbinary_flag:

     in reply to

     this is a fantastic use case for certificate compression

   • Embed this notice
     Robin Bradshaw (en4rab@infosec.exchange)'s status on Saturday, 18-May-2024 20:41:37 JST Robin Bradshaw

     in reply to

     @ryanc These sites should notice:
     https://www.sslmarket.com/ssl-verification-tool/
     https://www.sslchecker.com/sslchecker
     https://dnschecker.org/ssl-certificate-examination.php
     https://ipsaya.com/en/ssl-tls

     Ryan Castellucci :nonbinary_flag: repeated this.
   • Embed this notice
     Ryan Castellucci :nonbinary_flag: (ryanc@infosec.exchange)'s status on Sunday, 19-May-2024 18:58:00 JST Ryan Castellucci :nonbinary_flag:

     in reply to

     • Robin Bradshaw

     @en4rab
     Well, https://www.sslmarket.com/ssl-verification-tool/ is definitely vulnerable to XSS via crafted certificate.