Windows CryptoAPIã®è„†å¼±æ€§ã«ã‚ˆã‚‹ECC証明書ã®å½é€ (CVE-2020-0601) - ã¼ã¡ã¼ã¡æ—¥è¨˜
1. ã¯ã˜ã‚ã« ã¤ã„先日ã®Windowsã®ã‚»ã‚ュリティアップデートã§Windowsã®CryptoAPIã®æ¥•å††æ›²ç·šæš—å·å‡¦ç†ã«é–¢é€£ã—ãŸè„†å¼±æ€§ã®ä¿®æ£ãŒè¡Œã‚ã‚Œã¾ã—ãŸã€‚ 「CVE-2020-0601 | Windows CryptoAPI Spoofing Vulnerability〠ã“ã‚ŒãŒã¾ã世界ã®æš—å·å°‚門家をä¸å¿ƒã«ã‚»ã‚ュリティæ¥ç•Œã‚’é©šã‹ã›ã€ã„ã‚ã„ã‚騒ãŒã—ã¦ã„ã¾ã™ã€‚ ãã®é©šãã®ä¸€ã¤ã¯ã€ã“ã®è„†å¼±æ€§ã®å ±å‘Šè€…ãŒNSA(米国家安全ä¿éšœå±€)ã ã£ãŸã“ã¨ã§ã™ã€‚NSAã¯Microsoftã®ã‚¢ãƒŠã‚¦ãƒ³ã‚¹ã¨ã¯åˆ¥ã«ã‚ˆã‚Šè©³ã—ã„内容ã§ã“ã®è„†å¼±æ€§ã‚’è¦å‘Šã™ã‚‹ã‚¢ãƒŠã‚¦ãƒ³ã‚¹ã‚’出ã—ã¦ã„ã¾ã™ã€‚ 「Patch Critical Cryptographic Vulnerability in Microsoft Windows Clients and Servers〠ã“ã‚Œã¾ã§æ•°ã€…ã®è«œå ±æ´»å‹•ã‚’インターãƒãƒƒãƒˆä¸Šã§è¡Œã£ã¦ããŸNSAãŒã€ã“ã®è„†å¼±æ€§ã‚’
Let's EncryptãŒã¯ã¾ã£ãŸGolangã®è½ã¨ã—ç©´ - ã¼ã¡ã¼ã¡æ—¥è¨˜
0. çŸã„ã¾ã¨ã‚ 300万以上ã®è¨¼æ˜Žæ›¸ã®å¤±åŠ¹ã‚’迫られãŸLet's Encryptã®ã‚¤ãƒ³ã‚·ãƒ‡ãƒ³ãƒˆã¯ã€ŒGolangã§ã‚ˆãã‚ã‚‹é–“é•ã„ã€ã¨æ›¸ã‹ã‚Œã¦ã„るよã†ãªãƒã‚°ãŒåŽŸå› ã§ã—ãŸã€‚ 1. ã¯ã˜ã‚ã«ã€ Let's Encryptã¯ã€ç„¡æ–™ã§ã‚µãƒ¼ãƒè¨¼æ˜Žæ›¸ã‚’自動化ã—ã¦ç™ºè¡Œã™ã‚‹ã‚µãƒ¼ãƒ“スを行ã†éžå–¶åˆ©å›£ä½“ã¨ã—ã¦2014å¹´ã«è¨ç«‹ã•ã‚Œã¾ã—ãŸã€‚ 2015å¹´ã«ã‚µãƒ¼ãƒ“ス開始ã•ã‚Œã‚‹ã¨è¨¼æ˜Žæ›¸ã®ç™ºè¡Œæ•°ã¯ãã‚“ãん伸ã³ã€å…ˆæœˆæœ«ã®ãƒ—レスリリースã§ã¯ç´¯è¨ˆ10å„„æžšã®ã‚µãƒ¼ãƒè¨¼æ˜Žæ›¸ã‚’発行ã—ãŸã“ã¨ãŒã‚¢ãƒŠã‚¦ãƒ³ã‚¹ã•ã‚Œã¾ã—ãŸã€ŒLet's Encrypt Has Issued a Billion Certificatesã€ã€‚CTLogã®èª¿æŸ»ã‹ã‚‰ã€2020å¹´2月末ã®æ™‚点ã§ã¯æœ‰åŠ¹ãªå…¨è¨¼æ˜Žæ›¸ã®38.4%ãŒLet's Encryptã®è¨¼æ˜Žæ›¸ã§ã‚ã‚‹ã¨ã¿ã‚‰ã‚Œã¦ã„ã¾ã™ã€ŒCertificate Validity Datesã€ã€‚ ç„¡æ–™ã®è¨¼æ˜Žæ›¸ã‚’æä¾›ã—ã¦ã‚‚らãˆã‚‹ã®ã¯éžå¸¸ã«å¬‰ã—
無料㮠SSL 証明書ãŒå¾—られる ZeroSSL を使ã£ã¦ã¿ãŸ
ã¯ã˜ã‚㫠皆ã•ã‚“㯠ZeroSSL を知ã£ã¦ã„ã¾ã™ã‹ï¼Ÿå€‹äººã§ã‚¦ã‚§ãƒ–サイトをé‹å–¶ã—ã¦ã„る皆ã•ã‚“ã§ã‚ã‚Œã°ã€å¤šãã®æ–¹ã¯ Let's Encrypt を利用ã•ã‚Œã¦ã„ã‚‹ã¨æ€ã„ã¾ã™ã€‚ https://letsencrypt.org/ja/ ã‚‚ã¡ã‚ん僕も使ã£ã¦ã„ã¾ã™ã€‚僕ã®æ§˜ãªã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ã®æ–¹ã§ã‚れ㰠SSL ã®ä»•çµ„ã¿ã‚‚ãŠãŠã‚ˆãç†è§£ã‚‚ã—ã¦ã„ã‚‹ã—ã€ã‚³ãƒžãƒ³ãƒ‰ãƒ©ã‚¤ãƒ³ã®å®Ÿè¡Œæ–¹æ³•ã‚‚知ã£ã¦ãŠã‚‰ã‚Œã‚‹ã®ã§ã‚¦ã‚§ãƒ–サイト㮠SSL 証明書をå–å¾—ã™ã‚‹äº‹ã‚‚ãã‚Œã»ã©é›£ã—ã„事ã§ã¯ãªã„ã§ã—ょã†ã€‚ ã—ã‹ã—ãã‚Œã»ã©è©³ã—ããªã„方㌠certbot ã®æ§˜ãªã‚³ãƒžãƒ³ãƒ‰ã‚’使ã£ã¦ SSL 証明書を発行ã™ã‚‹ã®ã¯å‰²ã¨é›£ã—ã„事ã§ã™ã€‚ãã“ã§ã”紹介ã—ãŸã„ã®ãŒ ZeroSSL ã§ã™ã€‚ https://zerossl.com/ ZeroSSL ã¨ã¯ ZeroSSL ã‚‚ã¾ã ã‚ã¾ã‚Šåå‰ãŒçŸ¥ã‚‰ã‚Œã¦ã„ãªã„ã›ã„ã‹ã€Google 検索ã§ã€ŒZeroSSLã€ã‚’検索ã™ã‚‹ã¨ã€ŒZeroS
Finding real IPs of origin servers behind CloudFlare or Tor
Finding The Real Origin IPs Hiding Behind CloudFlare or Tor Tor hidden services and reverse-proxy providers (e.g. CloudFlare) are useless if you are making simple mistakes. This is how you can reveal origin IPs when you make a mistake. Hidden services and the effectiveness of CloudFlare or any similar service live from hiding the origin servers IP. Simple small mistakes can reveal the IP. This all
1
ランã‚ング
ãŠçŸ¥ã‚‰ã›
ランã‚ング
リリースã€éšœå®³æƒ…å ±ãªã©ã®ã‚µãƒ¼ãƒ“スã®ãŠçŸ¥ã‚‰ã›
最新ã®äººæ°—エントリーã®é…ä¿¡
j次ã®ãƒ–ックマーク
kå‰ã®ãƒ–ックマーク
lã‚ã¨ã§èªã‚€
eコメント一覧を開ã
oページを開ã
GitHub - shdwpwn/rsescan: RSEScan is a command-line utility for interacting with the RSECloud. It allows you to fetch subdomains and IPs from certificates for a given domain or organization.
https://censys.com/wp-content/uploads/2023/10/Censys-Search-Host-Queries.pdf
IT Infrastructure Reconnaissance – Part 2 (Shodan, Censys, ZoomEye) - research.securitum.com
GitHub - cheetz/sslScrape: SSLScrape | A scanning tool for scaping hostnames from SSL certificates.
Cloudflare, how to do it right and don't reveal your real IP
Hunting a TLS certificate series — Post 1
By the way, the list of SSL/TLS certificates issued to you (including subdomains) is public!
SecurityTrails | Risks of modern free SSL certificates and stale DNS records
Certificates: The OSINT Gift that Keeps on Giving… – We will always be OSINTCurio.us
GitHub - chrispetrou/HRShell: HRShell is an HTTPS/HTTP reverse shell built with flask. It is an advanced C2 server with many features & capabilities.
{{#tags}}- {{label}}
{{/tags}}