Скачать или смотреть Ethical Hacker Lab - Finding Information from SSL Certificates 3.1.14

Objectives
View Certificate Information on Hosts
Access Detailed Certificate Information
Use SSL Analysis Tools in Kali
Use Kali Tools to Gather Certificate Information
Background / Scenario
SSL/TLS certificates provide two broad functions. First, they provide a way that the ownership of a website can be validated by people who are accessing it. Second, they provide a means by which communication between a client and server is encrypted so that it cannot be read or altered by unauthorized parties. They also provide the information required for a browser to create a secure, encrypted connection to a web site over the HTTPS protocol. Certificates are used behind the scenes as users browse the internet. In most cases, users are not aware that they are in use. The users become aware of them if a certificate is missing, out of date, or misconfigured.

Certificate information can be viewed locally for a website that is currently displayed in a browser by clicking the padlock icon next to the URL in the browser. Certificates are also stored locally for the certificate authorities themselves. There are various ways to view them. The format of public key certificate information is specified by the X.509 standard.

Ethical hackers can use public certificate information in the reconnaissance phase of penetration tests. Certificate information can reveal details about an organization including domain and subdomain names, issuance and expiration dates, and certificate public keys. In addition, certain versions of software, such as OpenSSL, have widely known vulnerabilities that can be exploited, including vulnerability to the heartbleed bug. In addition, it is possible that some certificates could use weak encryption algorithms.

Required Resources
Kali VM customized for Ethical Hacker course
Internet access