I exploited TLS-SNI-01 issuing Let's Encrypt SSL-certs for any domain (2018)

Re:I exploited TLS-SNI-01 issuing Let's Encrypt SSL-certs fo... by WatchDog on Tuesday January 29, 2019 @06:06PM (#19030775)

If you have misconfigured cookies, having your server accept port 80 or not wont matter to a non-passive man-in-the-middle. They will just accept port 80 traffic and read the cookies.

[ Parent | on HN ]

Re:I exploited TLS-SNI-01 issuing Let's Encrypt SSL-certs fo... by schoen on Tuesday January 29, 2019 @06:28PM (#19030980)

It's clear that there's a difference between an active and a passive attacker here. Closing port 80 protects against the passive attacker, but not against the active attacker (with regard to SSL stripping, insecure submission of old forms, and cookies not flagged as secure). Both kinds of attackers are real.

[ Parent | on HN ]

Re:I exploited TLS-SNI-01 issuing Let's Encrypt SSL-certs fo... by qu4z-2 on Tuesday January 29, 2019 @08:27PM (#19031725)

I'm fairly sure you can also just get the client to request http://example.com:443/. The cookies get sent before the server goes "Wait, what?".

[ Parent | on HN ]

Re:I exploited TLS-SNI-01 issuing Let's Encrypt SSL-certs fo... by schoen on Tuesday January 29, 2019 @10:11PM (#19032303)

This thread seems to agree with you:

https://stackoverflow.com/questions/1612177/are-http-cookies...

I just tested this and I was able to confirm your suggestion with Firefox, watching with a packet sniffer while connecting to my own site with http://example.com:443/ after previously setting a cookie over https://example.com/. The cookie was clearly visible in the packet log.

[ Parent | on HN ]