Ecosyste.ms: Awesome
An open API service indexing awesome lists of open source software.
awesome-tls-hacks
A collection of SSL/TLS security related resources.
https://github.com/lennysec/awesome-tls-hacks
- RFC 2246
- RFC 4346
- RFC 5246
- RFC 8446
- Klima, Vlastimil, Ondrej Pokorný, and Tomáš Rosa. "Attacking RSA-based sessions in SSL/TLS." International Workshop on Cryptographic Hardware and Embedded Systems. Springer, Berlin, Heidelberg, 2003.
- Rizzo, Juliano, and Thai Duong. "Here come the xor ninjas." In Ekoparty Security Conference, 2011.
- Al Fardan, Nadhem J., and Kenneth G. Paterson. "Lucky thirteen: Breaking the TLS and DTLS record protocols." 2013 IEEE Symposium on Security and Privacy. IEEE, 2013.
- Möller, Bodo, Thai Duong, and Krzysztof Kotowicz. "This POODLE bites: exploiting the SSL 3.0 fallback." Security Advisory (2014).
- Aviram, Nimrod, et al. "DROWN: Breaking TLS Using SSLv2." 25th USENIX Security Symposium (USENIX Security 16). 2016.
- AlFardan, Nadhem, et al. "On the Security of RC4 in TLS." Presented as part of the 22nd USENIX Security Symposium (USENIX Security 13). 2013.
- Garman, Christina, Kenneth G. Paterson, and Thyla Van der Merwe. "Attacks Only Get Better: Password Recovery Attacks Against RC4 in TLS." 24th USENIX Security Symposium (USENIX Security 15). 2015.
- Mantin, Itsik. "Bar-Mitzva Attack: Breaking SSL with 13-Year Old RC4 Weakness." Black Hat Asia (2015).
- Vanhoef, Mathy, and Frank Piessens. "All your biases belong to us: Breaking RC4 in WPA-TKIP and TLS." 24th USENIX Security Symposium (USENIX Security 15). 2015.
- Rizzo, Juliano, and Thai Duong. "The CRIME attack." Ekoparty Security Conference. 2012.
- Be’ery, Tal, and Amichai Shulman. "A perfect CRIME? only TIME will tell." Black Hat Europe 2013 (2013).
- Prado, A., N. Harris, and Y. Gluck. "The BREACH Attack." (2013).
- Bleichenbacher, Daniel. "Chosen ciphertext attacks against protocols based on the RSA encryption standard PKCS# 1." Annual International Cryptology Conference. Springer, Berlin, Heidelberg, 1998.
- Böck, Hanno, Juraj Somorovsky, and Craig Young. "Return Of Bleichenbacher’s Oracle Threat (ROBOT)." 27th USENIX Security Symposium (USENIX Security 18). 2018.
- Durumeric, Zakir, et al. "The matter of heartbleed." Proceedings of the 2014 conference on internet measurement conference. 2014.
- Bhargavan, Karthikeyan, et al. "Triple handshakes and cookie cutters: Breaking and fixing authentication over TLS." 2014 IEEE Symposium on Security and Privacy. IEEE, 2014.
- Beurdouche, Benjamin, et al. "A messy state of the union: Taming the composite state machines of TLS." 2015 IEEE Symposium on Security and Privacy. IEEE, 2015.
- Adrian, David, et al. "Imperfect forward secrecy: How Diffie-Hellman fails in practice." Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security. 2015.
- Bhargavan, Karthikeyan, and Gaëtan Leurent. "Transcript Collision Attacks: Breaking Authentication in TLS, IKE, and SSH." In Network and Distributed System Security Symposium (NDSS). 2016.
- NSS - 03 | Mozilla, AOL, Red Hat, Sun, Oracle, Google and others | C, Assembly |
- OpenSSL - 12 | OpenSSL Project | C, Assembly |
- GnuTLS - 03 | GnuTLS Project | C |
- wolfSSL - 02 | wolfSSL | C |
- MbedTLS - 01 | Arm | C |
- BoringSSL - 06 | Google | C, C++, Go, Assembly |
- s2n - 06 | Amazon | C |
- LibreSSL - 07 | OpenBSD Project | C, Assembly |
- Rustls - 08 | Joseph Birr-Pixton etc. | Rust |
- Fizz - 06 | Facebook | C++ |
- Facebook Fizz integer overflow vulnerability (CVE-2019-3560)
- Facebook Fizz memory leak vulnerability (CVE-2019-11924) reproduce and analysis
- Mozilla NSS TLS 1.3 CCS Flood remote DoS Attack