Resources

People often ask me "How did you learn how to hack?" The answer: by reading. This page is a collection of the blog posts and other articles that I have accumulated over the years of my journey. Enjoy!

TLS (Transport Layer Security) does all of the fancy encryption of internet traffic. A feature of TLS is that it has the ability to resume a previous session.

The resumption feature (on GNU TLS) does not validate that the previous connector and the new connector are different! There is supposed to be a credential check at this resumption stage. However, this appears to be missing.

In TLS 1.3, this can be used to bypass authentication for the server. For TLS 1.2, the keys have NOT been zeroed out. Hence, it is possible to recover previous messages!