More Tricks For Defeating SSL In Practice

A Third Cut: ocsp-aware sslsniffsslsniff●Watch network and fingerprints clients for level ofvulnerability.● Every NSS client's communication is intercepted –either with a specific “null termination” certificate, orwith the “universal wildcard” certificate.●●●Every non-NSS client that is vulnerable is interceptedwith a “null termination” certificate if available for thedestination host.Non-vulnerable clients are left alone to avoiddetection.Optionally watch for OCSP requests corresponding tocertificates we're using, and “tryLater” them to defeatOCSP.Moxie MarlinspikeInstitute For Disruptive Studies