关联漏洞
标题:Square OkHttp 安全漏洞 (CVE-2016-2402)Description:Square OkHttp是美国Square公司的一套用于Android系统和Java应用程序的HTTP和HTTP /2客户端软件。该软件支持同步阻塞调用和回调的异步调用、响应缓存避免网络重复请求等。 Square OkHttp 2.7.4之前的版本和3.1.2之前的3.x版本中存在安全漏洞。攻击者可利用该漏洞实施中间人攻击，绕过证书锁定。
Description
Simple script for testing CVE-2016-2402 and similar flaws
介绍
# cert pinning flaw POC
Simple POC script for testing CVE-2016-2402 and similar flaws. Read [my blog post](https://koz.io/pinning-cve-2016-2402) for details.
This utility will set up a HTTPS server that servers a malicious certificate chain to the client for a specific domain.
If traffic from an app with a vulnerable certificate pinning implementation is redirected to this server,
the pinning control will be bypassed and you should be able to see a GET or a POST request in the server console.
By default, this uses a hardcoded CA certificate and key (CA_CERT.pem and CA_KEY.pem files).
You can change these, use the following command to generate a new pair.
`openssl req -x509 -days 1825 -nodes -newkey rsa:2048 -outform pem -keyout CA_KEY.key -out CA_CERT.pem`
You will want to insert CA_CERT.pem to the platform being tested.
John Kozyrakis
文件快照
[4.0K] /data/pocs/c44ec065efe138cce89026c2dc30ffe2e30396dd
├── [1.2K] CA_CERT.pem
├── [1.7K] CA_KEY.pem
├── [5.7K] cert-pinning-flaw-poc.py
├── [1.1K] LICENSE
└── [ 856] README.md
0 directories, 5 files
备注
1. 建议优先通过来源进行访问。
2. 本地 POC 快照面向订阅用户开放；当原始来源失效或无法访问时，本地镜像作为订阅权益的一部分提供。
3. 持续抓取、验证、维护这份 POC 档案需要不少投入，因此本地快照已纳入付费订阅。您的订阅是让这份资料能继续走下去的关键，由衷感谢。 查看订阅方案 →