From: Skip Carter (skip@taygeta.com)
Date: Wed Mar 31 2004 - 18:23:02 EST
> whilst in the middle of a Penetration Test I stumbled on a web server only
> serving SSL and demanding the client to present
> a certificate to identify himself.
...
> Does anyone have an idea to further assess this server? Am I looking at a
> mission impossible here maybe?
Its likely that the server not only expects a certificate from the
client, but that it be signed by a PARTICULAR CA (maybe a local/private one).
You might need to figure out a way to get such a certificate (via social
engineering perhaps ?).
Skip
-- Dr. Everett (Skip) Carter Phone: 831-641-0645 FAX: 831-641-0647 Taygeta Scientific Inc. INTERNET: skip@taygeta.com 1340 Munras Ave., Suite 314 WWW: http://www.taygeta.com Monterey, CA. 93940
This archive was generated by hypermail 2.1.7 : Sat Apr 12 2008 - 10:53:51 EDT