From: Brad Showalter (pris_brad@yahoo.com)
Date: Thu Apr 22 2004 - 13:40:19 EDT
This is late, my last response never made it to the list, but you may find it useful in future engagements.
Instead of attempting to fool the server, look for vulnerable clients likely to already be in possession of valid web certs (more easily accomplished in internal pen studies than external ones). I believe, by default, the IE browser does not require a password to protect the cert store, so there is a good chance you'd be able to simply export the browser cert to your PC once having gained access to the vulnerable client. Netscape/Mozilla requires password protection of cert stores, to the best of my knowledge, but are very prevalent in corporate environments.
Best of luck,
-Brad
>Hi to all,
>
>whilst in the middle of a Penetration Test I stumbled on a web server only
>serving SSL and demanding the client to present
>a certificate to identify himself.
>I tried to nikto it with sslproxy and browse the site thru paros both with a
>temporary Verisign personal certificate.
>No such luck, the server keeps bouncing me off. Even vulnerability scanners
>like Nessus and Retina don't get passed
>the port-scan portion.
>
>Does anyone have an idea to further assess this server? Am I looking at a
>mission impossible here maybe?
>
>Thanks,
>
>~kevin
------------------------------------------------------------------------------
Ethical Hacking at the InfoSec Institute. Mention this ad and get $545 off
any course! All of our class sizes are guaranteed to be 10 students or less
to facilitate one-on-one interaction with one of our expert instructors.
Attend a course taught by an expert instructor with years of in-the-field
pen testing experience in our state of the art hacking lab. Master the skills
of an Ethical Hacker to better assess the security of your organization.
Visit us at:
http://www.infosecinstitute.com/courses/ethical_hacking_training.html
-------------------------------------------------------------------------------
This archive was generated by hypermail 2.1.7 : Sat Apr 12 2008 - 10:53:52 EDT