SSL Misconfiguration

Overview SSL Misconfiguration causes a variety of issues such as sensitive pages being accessible via HTTP, use of weak SSL ciphers, and SSL stripping. Discovery Methodology Use an SSL cipher audit tool such as SSLScan to test cipher strength. Observe how the site handles an HTTP request. If the site redirects the user to HTTPS, the site can be stripped. Exploitation For SSLStripping, after ARP poisoning the client and the gateway, use SSLStrip to remove SSL connection. To test cipher strength, the following tools are helpful sslscan sslscan --targets=hosts.txt NMap nmap -p 443 -v -Pn --script=ssl-enum-ciphers --open -iL hosts.txt Videos Click here to watch How to Test for Weak SSL/TLS HTTPS ciphers Click here to watch Using Ettercap and SSLstrip to Capture Credentials