full-disclosure - Re: Webwasher SSL scanner

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Mon, 24 Dec 2007 18:09:03 -0800
From: coderman <coderman@...il.com>
To: full-disclosure <full-disclosure@...ts.grok.org.uk>
Subject: Re: Webwasher SSL scanner

On Dec 24, 2007 3:53 PM, coderman <coderman@...il.com> wrote:
> i am looking for details of the PKI for integration of webwasher ssl
> scanner into an organization.

thanks to those who responded.  in the interest of propagating useful
information:

the structure of PKI implemented in an organization is external to the
device.  you load a CA key (can be a root or not) into the device and
ensure that all clients have that CA cert as trusted.  the device can
then MitM to any site on demand (but may restrict to approved sites
only).

grab a cert from this unit, and you can MitM yourself all day long.

interestingly enough, i am certain this does not support client side
certs.  (for example, we use VeriSign client certs for mutual
authentication in some situations.  this would be broken behind an SSL
scanner.)

best regards, happy holidays,

:)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/