Collection of TLS vulnerabilities ready to be exploited.

elliptic-curve-cryptography timing-attacks tls13

Go to file

otsmr 6425910023 add test		2023-12-21 12:51:07 +01:00
dual_ec	change back to dual_ec	2023-04-21 18:38:04 +02:00
psychic_signatures	add test	2023-12-21 12:51:07 +01:00
tests@7dd779ec91	add test	2023-12-21 12:51:07 +01:00
timing_issues	remove char	2023-04-19 22:09:09 +02:00
.gitignore	add cargo lock	2023-04-21 18:38:34 +02:00
.gitmodules	add test	2023-12-21 12:51:07 +01:00
Cargo.toml	add test	2023-12-21 12:51:07 +01:00
README.md	update text	2023-05-04 10:10:42 +02:00

README.md

VulnTLS

VulnTLS is a series of CTF challenges. The series implements several vulnerabilities. Most of the vulnerabilities were already present in common TLS implementations. The series provides a basic understanding of TLS and typical implementation vulnerabilities, with a focus on cryptography.

In this repository there are different setups to exploit the different vulnerabilities. For this it uses the vulnerable implementation, which has its own branch in the AnotherTLS repository.

Vulnerabilities

The vulnerabilities are marked with there difficulty (EASY, HARD, EXTREME). The evaluation is of course subjective and designed for a bachelor student.

Psychic signatures (EASY)

Bypass the client certificate authentication! Run the challenge.

cargo run --bin psychic_signatures

Timing issues (HARD)

Get the private key of the server! Run the challenge.

cargo run --bin timing_issues

Dual_EC (HARD)

Decrypt the captured connection! See challenge for more.