certmitm - A tool for testing for certificate validation vuln

项目说明

certmitm

A tool for testing for certificate of TLS connections made by a client device or an application.

Created by Aapo Oksman - - MIT License

Published in DEF CON 31 on August 11 2023

YouTube: DEF CON 31 - certmitm: automatic exploitation of TLS certificate - Aapo Oksman

DEF CON 31 certmitm Slides.pdf

DEF CON 31 certmitm Demo.mp4

Installation

certmitm has been tested on Debian 11 and Debian 12. It should work on Linux with Python 3.10 and up

Install required python packages with

Obtain real certificates such as a Let's Encrypt certificate and save them to real_certs

Usage

First you need to intercept TLS connections. The easies way for this is to configure the computer running certmitm to act as a router for other devices in the network.

For example:

1. Start a DHCP/DNS server

2. Intercept TLS connections from the clients and redirect other connections to the internet through the WLAN interface

3. Start certmitm

4. Connect clients to the network and start applications. Note that you might need to retry running the applications a couple of times while the tests fail.

You should see any intercepted connections in the output of certmitm as CRITICAL. Additionally, if you run certmitm with the --/-v flag, you will see also properly secured connections as INFO. Below you can see an example where connections to google.com are secured properly but connections to www.google.com can be intercepted.

You can also recreate these secure and insecure connections with curl on a Linux machine connected to certmitm. You can also see that curl gi errors for different certmitm tests.

To log TLS session secrets for successfully intercepted TLS connections, you can set the SSLKEYLOGFILE en . This file can then be used to decrypt the captured TLS traffic in tools such as Wireshark (_Edit → Preferences → Protocols → TLS → (Pre)-Master-Secret log filename_).

Hall of fame

List of publicly disclosed found with certmitm. Open an issue if you ha a with certmitm and want to be included.

| Author | Product | Details | CVE |
| ------------- | ------------- | ----------- | --- |
| Aapo Oksman [[in]]() [[X]]() | Microsoft Azure Java SDK | Microsoft ad | C |
| Aapo Oksman [[in]]() [[X]]() | Microsoft Azure C SDK | Microsoft ad | C |
| Aapo Oksman [[in]]() [[X]]() | Disk-o-cloud | HackerOne report | |
| Aapo Oksman [[in]]() [[X]]() | Apple iOS App Store | Apple security update | C |
| Aapo Oksman [[in]]() [[X]]() | Microsoft Intune | Microsoft ad | C |
| Aapo Oksman [[in]]() [[X]]() | Acronis True Image | Acronis ad, HackerOne report | C |
| Aapo Oksman [[in]]() [[X]]() | Microsoft Windows Authentication | Microsoft ad | C |
| Aapo Oksman [[in]]() [[X]]() | Mattermost iOS | Mattermost ad MMSA-2023-00220 | C |
| Aapo Oksman [[in]]() [[X]]() | Microsoft Windows Enroll Engine | Microsoft ad | C |
| Aapo Oksman [[in]]() [[X]]() | Samsung Email for Android | Samsung ad S | C |
| Aapo Oksman [[in]]() [[X]]() | Apple Books for iOS, macOS and watchOS | macOS Sonoma 14 security updates, iOS 17 and iPadOS 17 security updates, watchOS 10 security updates | |
| Aapo Oksman [[in]]() [[X]]() | Line iOS | HackerOne report | C |
| Dennis Giese [[in]]() [[X]](), Braelynn Luedtke [[in]]() | Planet Fitness App (iOS, Android) | write-up | C |
| Tomi Koski [[in]]() [[X]]() | Leno Device Client (UDC) | Leno | C |

项目信息

开发语言：Python

Star 数：734

技术要点

该项目属于漏洞知识库方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A tool for testing for certificate validation vulnerabilities of TLS connections made by a client device or an application.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。