Collection of TLS vulnerabilities ready to be exploited.
Go to file
otsmr 6425910023 add test 2023-12-21 12:51:07 +01:00
dual_ec change back to dual_ec 2023-04-21 18:38:04 +02:00
psychic_signatures add test 2023-12-21 12:51:07 +01:00
tests@7dd779ec91 add test 2023-12-21 12:51:07 +01:00
timing_issues remove char 2023-04-19 22:09:09 +02:00
.gitignore add cargo lock 2023-04-21 18:38:34 +02:00
.gitmodules add test 2023-12-21 12:51:07 +01:00
Cargo.toml add test 2023-12-21 12:51:07 +01:00 update text 2023-05-04 10:10:42 +02:00


VulnTLS is a series of CTF challenges. The series implements several vulnerabilities. Most of the vulnerabilities were already present in common TLS implementations. The series provides a basic understanding of TLS and typical implementation vulnerabilities, with a focus on cryptography.

In this repository there are different setups to exploit the different vulnerabilities. For this it uses the vulnerable implementation, which has its own branch in the AnotherTLS repository.


The vulnerabilities are marked with there difficulty (EASY, HARD, EXTREME). The evaluation is of course subjective and designed for a bachelor student.

Psychic signatures (EASY)

Bypass the client certificate authentication! Run the challenge.

cargo run --bin psychic_signatures

Timing issues (HARD)

Get the private key of the server! Run the challenge.

cargo run --bin timing_issues

Dual_EC (HARD)

Decrypt the captured connection! See challenge for more.