“tls”的搜索结果

Audit TLS/SSL, the technology that encrypts network connections, across servers and mobile apps. The skill covers outdated protocols, weak encryption, certificate validation failures, known vulnerabilities, and replay risks, helping organize evidence and prioritize fixes.

中文简介正在准备中。当前显示英语简介。

• Auditing server protocols, encryption settings, and certificates
• Reviewing certificate validation in mobile apps
• Assessing TLS 1.3 replay risks and mutual authentication

Configure TLS 1.3, a protocol for encrypted connections, on nginx, Apache, and Python applications. Select encryption settings and key exchange groups, disable outdated protocols, and use openssl s_client and testssl.sh to check connections and configuration weaknesses.

中文简介正在准备中。当前显示英语简介。

• Enabling TLS 1.3 on nginx or Apache
• Configuring encrypted connections in a Python application
• Disabling outdated TLS versions and weak encryption

Set up mutual TLS, where services verify each other's certificates, to secure internal communication. The skill guides certificate hierarchy, rotation, gradual enforcement, and troubleshooting connection failures across services and clusters.

中文简介正在准备中。当前显示英语简介。

• Introduce zero-trust service communication
• Plan certificate rotation and expiry monitoring
• Investigate TLS handshake failures

Plan encryption, TLS connections, digital signatures, and key management using established cryptographic libraries. Get guidance on choosing algorithms, storing passwords, rotating keys, and avoiding implementation mistakes such as reused nonces or comparisons that reveal information through timing.

中文简介正在准备中。当前显示英语简介。

• Choosing encryption methods for stored data
• Reviewing TLS settings for encrypted connections
• Designing password storage and token signatures

Analyze a target's TLS configuration — negotiated protocol version, cipher suite, certificate chain, expiry, and downgrade vectors. Use when: SOC2 auditor flagged your endpoint for "weak TLS" but you don't know which control failed (TSC CC6.7 transmission integrity vs CC6.6 encryption) or which cipher is the problem. Threshold: any negotiated TLSv1.0 or TLSv1.1, OR a cipher with RC4 / 3DES / null / EXPORT, OR a cert with under 30 days to expiry, OR a chain that fails hostname verification. Trigger with: "audit tls", "check ssl config", "weak tls", "analyze tls".

中文简介正在准备中。当前显示原文说明。

Assess enterprise Wi-Fi that uses 802.1X, a system for authenticating individual users or devices. Covers identifying authentication methods, testing rogue access points, reviewing certificate trust and storage, and assessing domain access through recovered credentials.

中文简介正在准备中。当前显示英语简介。

• Identify authentication methods on enterprise Wi-Fi
• Review client validation of authentication server certificates
• Assess EAP-TLS certificate storage and issuance

Comprehensive methodology for auditing and exploiting TLS/SSL implementations and misconfigurations across network services and mobile applications. Covers protocol downgrade attacks including POODLE (CVE-2014-3566) against SSLv3 CBC padding, DROWN (CVE-2016-0800) cross-protocol attack leveraging SSLv2 export ciphers to decrypt TLS sessions, and FREAK (CVE-2015-0204) forcing RSA export-grade key exchange. Addresses BEAST (CVE-2011-3389) exploiting CBC IV predictability in TLS 1.0, CRIME (CVE-2012-4929) and BREACH targeting TLS-level and HTTP-level compression oracles respectively, and Heartbleed (CVE-2014-0160) for OpenSSL memory disclosure. Covers certificate validation bypass techniques for applications with improper hostname verification or chain validation, certificate pinning bypass using Frida and Objection for mobile application interception, HSTS bypass via NTP manipulation and subdomain exploitation, TLS 1.3 0-RTT replay attacks against non-idempotent endpoints, mutual TLS (mTLS) authentication a...

中文简介正在准备中。当前显示原文说明。

Deploy a Software-Defined Perimeter that connects verified users to authorized applications. Configure single-packet authorization, mutual certificate authentication, access policies, and monitoring, then test whether unauthorized connections and access between applications are blocked.

中文简介正在准备中。当前显示英语简介。

• Building zero trust access to internal applications
• Hiding services from unauthenticated network scans
• Testing certificate authentication and access restrictions

Build intermediary servers for authorized security exercises, separating public traffic from the command server used by the test team. It covers simple forwarding, request filtering with nginx or Apache, TLS certificates, and validation against the exercise’s traffic profile.

中文简介正在准备中。当前显示英语简介。

• Separating public infrastructure from an exercise command server
• Filtering exercise traffic against a defined profile
• Adding TLS certificates to a redirector

Monitor public Certificate Transparency logs, which record TLS certificates, to spot unexpected issuance and discover subdomains. Use crt.sh data to maintain a certificate inventory, check domain findings against DNS, and configure alerts for suspicious activity.

中文简介正在准备中。当前显示英语简介。

• Monitoring owned domains for unexpected certificate issuance
• Discovering subdomains and checking their DNS records
• Investigating certificates for look-alike domains

Search public TLS certificate records through crt.sh and pycrtsh to investigate lookalike domains, unexpected certificate issuers, and untracked IT assets. Compare domain spellings and review certificate details to support phishing detection and certificate monitoring.

中文简介正在准备中。当前显示英语简介。

• Finding domains that imitate a brand
• Reviewing unexpected certificate issuers
• Investigating untracked domains and IT assets

Write and review asynchronous C++ networking code using Boost.Asio or standalone Asio. The skill selects an implementation style for the installed library and C++ version, then checks memory lifetimes, concurrent writes, error handling, and build settings.

中文简介正在准备中。当前显示英语简介。

• Implementing asynchronous TCP or UDP servers and clients
• Reviewing buffer lifetimes and concurrent socket writes
• Adapting networking code to older Boost and C++ versions

Plan and configure command and control (C2) systems for red team exercises. Covers major frameworks, communication methods, relay servers, certificate management, and the network or endpoint signals defenders use to detect these systems.

中文简介正在准备中。当前显示英语简介。

• Compare C2 frameworks for a red team exercise
• Plan communication methods and relay infrastructure
• Review C2 detection signals from a defender's perspective

TLS/SSL configuration audit. Tests protocol versions (SSLv2/3, TLS 1.0/1.1/1.2/1.3), cipher strength and ordering, certificate chain validation (intermediates, CT logs, OCSP stapling, pinning), known vulnerabilities (POODLE, BEAST, CRIME, Heartbleed, ROBOT, DROWN, Ticketbleed, GOLDENDOODLE), session management (ticket reuse, resumption, fixation), renegotiation attacks, TLS 1.3-specific issues (0-RTT replay, PSK modes, downgrade), HSTS deep analysis (preload, subdomains, bypass), and certificate revocation (CRL, OCSP responder, stapled response freshness). Compliance-mapped to PCI DSS 4.0 (full Section 4), NIST SP 800-52r2, and FedRAMP. Uses testssl.sh, sslscan, sslyze, openssl, nmap NSE scripts, and nuclei SSL templates. Multi-port scanning across 20+ TLS-bearing services.

中文简介正在准备中。当前显示原文说明。

Audit whether a website serves all pages over HTTPS with valid TLS certificates, which secure connections. Check certificate coverage and expiration, permanent redirects from HTTP, and HTTPS URLs for internal links and resources, then review the necessary configuration changes.

中文简介正在准备中。当前显示英语简介。

• Auditing HTTPS coverage across a website
• Checking certificate expiration and hostname coverage
• Verifying permanent redirects from HTTP to HTTPS

Manage Sub2API through its administrator API using a bundled command-line tool. Inspect and update accounts, manage redeem codes, groups, and proxies, import or export accounts, and verify changes with follow-up reads.

中文简介正在准备中。当前显示英语简介。

• Reviewing account details and usage before updating settings
• Importing, exporting, or updating multiple accounts
• Generating and redeeming recharge or balance codes

Assess database security within an authorized scope by reviewing network exposure, authentication, access permissions, risky features, audit logs, and backup access. Distinguish configuration weaknesses from issues that can be demonstrated through safe validation.

中文简介正在准备中。当前显示英语简介。

• Reviewing database exposure and TLS settings
• Checking account privileges and sensitive table access
• Assessing dangerous features and configuration weaknesses

Audit Azure Blob and ADLS storage accounts for public exposure, risky access tokens, encryption settings, and insecure transport configurations. Use the azure-mgmt-storage Python SDK to produce a JSON report with account findings, severity ratings, and remediation recommendations.

中文简介正在准备中。当前显示英语简介。

• Auditing storage accounts across an Azure subscription
• Investigating suspected exposure through public blob access
• Reviewing SAS token permissions and expiration

Deploy Suricata to detect suspicious network traffic or block it inline. Configure protocol inspection, detection rules, and structured EVE JSON logs, then connect logs to analysis platforms and check packet drops and alert quality during operation.

中文简介正在准备中。当前显示英语简介。

• Deploying network intrusion monitoring
• Configuring inline blocking of malicious traffic
• Adding custom detection rules and reducing noisy alerts

Set up a Windows sandbox in Daytona to test OpenWork with a simulated corporate certificate authority. Check successful and broken HTTPS connections, the desktop app’s use of Windows trust, and certificate handling in runtimes it launches.

中文简介正在准备中。当前显示英语简介。

• Reproducing corporate certificate failures on Windows
• Checking OpenWork’s use of trusted Windows certificates
• Comparing valid and broken HTTPS certificate chains

Diagnose unreachable or unhealthy OpenShell gateways and sandbox startup failures. Identify the underlying execution platform, then examine logs, authentication, certificates, and configuration with the matching tools to narrow down the cause.

中文简介正在准备中。当前显示英语简介。

• Investigate gateway connection and health check failures
• Find why a sandbox remains pending or fails to start
• Check Docker or Podman runtime and image problems

Test iPolloWork's handling of corporate certificates in a Daytona Windows sandbox. Set up valid and broken HTTPS certificate chains, then verify that the desktop app and runtimes it starts use certificates trusted by Windows.

中文简介正在准备中。当前显示英语简介。

• Reproduce corporate certificate failures on Windows
• Verify that the app uses Windows certificate trust
• Compare valid and broken HTTPS certificate chains

Configures Amazon CloudFront content delivery across six workflows: when to use CloudFront and how it fits with AWS WAF, Shield, CloudFront Functions, Lambda@Edge, Route 53, and origins (creating a distribution, caching, and Flat Rate Pricing (FRP) versus pay-as-you-go pricing); managing custom-domain TLS certificates (ACM in us-east-1); configuring multi-tenant distributions; protecting origins with origin access control (OAC), VPC origins, and origin mutual TLS (mTLS); securing content with signed URLs and cookies, geographic restrictions, viewer mutual TLS, and edge token validation; and observing traffic with standard and real-time logs. Applicable when the customer wants to put CloudFront in front of content, choose pricing, lock an origin, restrict who can view content, or analyze logs. Not applicable for the Route 53 DNS side of a CloudFront custom domain or failover between distributions (see the route53-cloudfront skill), or for pure-Route 53 DNS work (see the route53 skill).

中文简介正在准备中。当前显示原文说明。

Configure TLS certificates and encryption for secure communications. Use when setting up HTTPS, securing service-to-service connections, implementing mutual TLS (mTLS), or debugging certificate issues.

中文简介正在准备中。当前显示原文说明。