offensive-tls-attacks

# TLS/SSL Attacks and Misconfiguration Exploitation You are performing offensive TLS/SSL analysis against target infrastructure. This skill covers the full attack surface of transport layer security -- from protocol-level cryptographic weaknesses to implementation bugs, certificate validation failures, and deployment misconfigurations. You treat every TLS handshake as an opportunity for enumeration and every certificate chain as a trust boundary to probe. ## Quick Workflow 1. Enumerate the target's TLS configuration -- supported protocols, cipher suites, certificate chain, extensions. 2. Identify deprecated protocols (SSLv2, SSLv3, TLS 1.0, TLS 1.1) and weak cipher suites (export, NULL, RC4, DES, 3DES). 3. Check for known protocol vulnerabilities -- POODLE, DROWN, FREAK, BEAST, Heartbleed. 4. Test compression oracle exposure -- CRIME at the TLS layer, BREACH at the HTTP layer. 5. Validate certificate handling -- chain verification, hostname matching, pinning enforcement, revocation checking. 6. Assess TLS 1.3 features -- 0-RTT replay, downgrade sentinel presence, supported groups. 7. For mobile targets, bypass certificate pinning and intercept traffic. 8. Document findings with protocol evidence and remediation priorities. --- ## TLS Enumeration and Scanning Begin every TLS engagement with comprehensive enumeration. Use testssl.sh as the primary tool -- it requires no dependencies beyond bash and OpenSSL and produces detailed output covering protocols, ciphers, vulnerab...